CVE-2026-47850

Analyzed Analyzed - Analysis Complete

Version Property Loss in Spring Data REST via HTTP PUT Request

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47850

EUVD

EUVD-2026-66820

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_data_rest	to 3.7.21 (exc)
vmware	spring_data_rest	From 4.0.0 (inc) to 4.4.16 (exc)
vmware	spring_data_rest	From 4.5.0 (inc) to 4.5.13 (exc)
vmware	spring_data_rest	From 5.0.0 (inc) to 5.0.6.1 (exc)
vmware	spring_data_rest	From 5.1.0 (inc) to 5.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring Data REST versions 3.7.20 and earlier, 4.0.0 to 4.4.15, 4.5.0 to 4.5.12, and 5.0.0 to 5.1.0. It allows authenticated users with PUT access to modify the version property of immutable aggregates, bypassing optimistic-locking protections. This happens because Spring Data REST does not preserve the persisted version property when handling PUT requests for immutable types or polymorphic subtype changes.

Detection Guidance

Detecting this vulnerability requires checking if your Spring Data REST application uses immutable aggregate roots with version properties exposed to PUT requests. Review application logs for PUT requests modifying version fields on immutable types. Check for concurrent modification anomalies or stale writes in data repositories.

Impact Analysis

This vulnerability enables stale writes and silent overwrites of concurrent updates. An attacker could submit a version value that overwrites the stored version, leading to data corruption or loss. Affected applications are those exposing a Spring Data REST repository with an immutable aggregate root containing a version property visible to Jackson's deserialization.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data modifications. The issue allows authenticated users to bypass optimistic-locking protections and overwrite stored data versions, potentially leading to stale writes or silent data corruption. Such unauthorized changes may violate integrity requirements under GDPR's data accuracy principle and HIPAA's integrity safeguards.

Mitigation Strategies

Upgrade Spring Data REST to fixed versions: 3.7.21, 4.4.16, 4.5.13, 5.0.7, or 5.1.1. No additional mitigation steps are required after upgrading. Ensure all dependencies are updated to prevent exposure.

Hi! I’m here to help you understand CVE-2026-47850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70