CVE-2026-47849

Analyzed Analyzed - Analysis Complete

JSON Patch Vulnerability in Spring Data REST

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47849

EUVD

EUVD-2026-66837

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_data_rest	to 3.7.21 (exc)
vmware	spring_data_rest	From 4.0.0 (inc) to 4.4.16 (exc)
vmware	spring_data_rest	From 4.5.0 (inc) to 4.5.13 (exc)
vmware	spring_data_rest	From 5.0.0 (inc) to 5.0.6.1 (exc)
vmware	spring_data_rest	From 5.1.0 (inc) to 5.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability in Spring Data REST allows authenticated users with PATCH access to modify entity identifier and version properties via JSON Patch requests. This bypasses security checks, potentially disabling optimistic-locking protection or enabling unauthorized data overwrites by different users.

Detection Guidance

Detect this vulnerability by checking if your Spring Data REST version is affected. Use commands like 'curl -s http://your-server/actuator/info' or check Maven/Gradle dependencies for versions 3.7.20 or earlier, 4.0.0-4.4.15, 4.5.0-4.5.12, or 5.0.0-5.1.0.

Impact Analysis

An attacker could exploit this to change critical entity properties, leading to data corruption, unauthorized modifications, or bypassing security controls like version tracking. This requires authenticated access but could allow privilege escalation or data integrity violations.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity requirements in GDPR and HIPAA. It may also compromise audit trails if version properties are altered, undermining compliance with data protection and record-keeping regulations.

Mitigation Strategies

Upgrade to fixed versions: 3.7.21, 4.4.16, 4.5.13, 5.0.7, or 5.1.1. No additional mitigation is required after upgrading. Ensure no public setters for @Id or @Version properties exist or are excluded from Jackson deserialization.

Hi! I’m here to help you understand CVE-2026-47849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70