Description

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T06:17:16.653Z",
  "pubdate": "2026-08-27T06:17:16.653Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the Spring Data REST framework, specifically concerning the handling of RFC 6902 JSON Patch (application/json-patch+json) requests.\nThe vulnerability allows remote, authenticated or unauthenticated attackers to mutate protected domain entity properties, specifically identifier (@Id) and version (@Version) fields, which are typically intended to be immutable after resource initialization.\nBy crafting a malicious JSON Patch request, an attacker can overwrite these internal metadata fields, potentially leading to unauthorized data corruption, integrity compromise, or bypass of optimistic locking mechanisms.\nThe scope of impact includes multiple versions of Spring Data REST across various maintenance branches. The risk implication is significant as it subverts the object-relational mapping (ORM) constraints and persistence logic managed by the underlying Spring Data abstraction layer.\nExploitation requires no specialized administrative privileges beyond the ability to submit JSON Patch operations to the REST interface, making it a critical concern for applications leveraging PATCH-based entity updates.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient enforcement of property-level access controls during the application of RFC 6902 JSON Patch operations. In Spring Data REST, the framework processes PATCH requests by mapping fields in the patch document to the underlying entity properties.\nWhile the framework typically respects internal metadata, the logic responsible for applying JSON Patch operations fails to explicitly filter or guard fields annotated with @Id or @Version from being targeted by 'replace' or 'add' operations.\nWhen a client sends an application/json-patch+json request, the framework deserializes the patch and executes the mutation against the managed entity. If the patch document includes a path corresponding to the entity's identifier or version field, the underlying data store or persistence context is updated without checking if these fields are subject to immutability constraints.\nThe attack flow follows these steps: First, an attacker identifies a REST resource endpoint that supports JSON Patch operations. Second, the attacker constructs a malicious JSON Patch request containing an operation (e.g., 'replace') directed at the @Id field to change the resource identifier or the @Version field to manipulate the optimistic locking state.\nBy modifying the @Id field, an attacker may force the application to associate the entity with a different identity, potentially leading to data collision or unauthorized access to other records. By modifying the @Version field, an attacker can artificially manipulate the version state, which can be leveraged to bypass optimistic concurrency controls, causing race conditions or enabling unauthorized updates to stale data.\nThe vulnerability affects: Spring Data REST 5.1.0, 5.0.0 - 5.0.6, 4.5.0 - 4.5.12, 4.0.0 - 4.4.15, and 3.7.20 and earlier. The exposure is network-based, occurring at the application layer of the Spring Data REST interface. Exploitation results in the subversion of the entity lifecycle management, potentially impacting the integrity of the database persistence layer by allowing direct manipulation of fields that define entity identity and state concurrency."
}