CVE-2026-86512
Received Received - Intake

Improper Access Control in json-patch Java Library

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-86512
EUVD
EUVD-2026-72613

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
java-json-tools json-patch to 1.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86512 is a vulnerability in the java-json-tools json-patch library up to version 1.13. It involves improper access controls in the CopyOperation.apply and MoveOperation.apply functions. Attackers can exploit this to copy sensitive data from restricted fields to public locations in JSON documents, leading to data exposure.

Detection Guidance

To detect this vulnerability, inspect applications using json-patch library version 1.13 or earlier. Check for unauthorized access to internal fields like passwords or API keys. Review API responses for sensitive data exposure. Use static code analysis to find unvalidated 'from' paths in CopyOperation.apply or MoveOperation.apply methods.

Impact Analysis

This vulnerability allows attackers to exfiltrate sensitive data like passwords or API keys from internal fields to public sections of JSON documents. It can lead to credential theft, cross-tenant data access, and exposure of sensitive personally identifiable information (PII).

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade to a patched version of json-patch if available. Implement path-access-control callbacks to validate 'from' paths. Restrict allowed 'from' paths to prevent access to sensitive fields. Add logging for suspicious patch operations. Review and sanitize API responses to exclude internal fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart