What is the CVSS score of CVE-2026-41728?

CVE-2026-41728 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Data REST are affected by CVE-2026-41728?

Spring Data REST versions 3.7 through 5.0.5 contain an authorization bypass in the JSON Patch handler that allows unauthenticated remote attackers to modify protected entity fields, exposing…. A patch is available.

How to fix or mitigate CVE-2026-41728?

Within 24 hours: Identify all systems running Spring Data REST versions 3.7.x through 5.0.5 and assess which expose JSON Patch endpoints. Within 7 days: Implement API gateway or WAF rules to restrict JSON Patch operations, apply strict input validation, and disable JSON Patch functionality if not required for business operations. Within 30 days: Monitor official Spring Data REST security advisories for patch availability and establish a patching timeline upon vendor release; conduct security testing to validate all mitigations.

Spring Data REST CVE-2026-41728

EUVD-2026-35905 HIGH

Improper Access Control (CWE-284)

2026-06-10 security@vmware.com

GHSA-cv39-x4c6-hhp2

Authentication Bypass Java Spring Data Rest

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:34 vuln.today

DescriptionCVE.org

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

AnalysisAI

Authorization bypass in Spring Data REST's JSON Patch handler allows remote unauthenticated attackers to modify protected entity fields by routing writes through intermediate path segments of a multi-segment JSON Pointer. The flaw affects Spring Data REST 3.7.x through 5.0.5 and carries a CVSS 7.5 (high) integrity-only impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Spring Data REST automatically exposes Spring Data repositories as hypermedia HTTP endpoints and supports partial updates via RFC 6902 JSON Patch (application/json-patch+json). The framework provides a write-access filter that enforces per-property access rules (typically via @JsonProperty(access = ...) or @RestResource(exported = false)) when patch operations target entity fields. The root cause is CWE-284 (Improper Access Control): when a JSON Pointer such as /parent/child/field traverses multiple segments, the filter is only evaluated against the final segment rather than each intermediate node along the path, allowing writes to be funneled through traversal segments that bypass the access policy. This is a logic flaw in the patch-resolution code path rather than a parser or deserialization defect.

RemediationAI

Upgrade Spring Data REST to a fixed release on your branch - based on the affected ranges, the first fixed versions are 3.7.20, 4.3.17, 4.4.15, 4.5.12, and 5.0.6 - and consult https://spring.io/security/cve-2026-41728 for the vendor's confirmed patched versions before pinning. As compensating controls until the upgrade ships, do not rely on JSON Patch field-level write filtering alone: temporarily reject the application/json-patch+json content type at the controller or gateway layer (clients can fall back to PUT/PATCH with application/json, at the cost of losing partial-update semantics), set @RepositoryRestResource(exported = false) on repositories that expose sensitive entities so they are not reachable via Spring Data REST at all, or place a Spring Security method-level rule on the repository save/update methods so authorization is enforced independently of the patch filter. Each workaround narrows the attack surface but breaks legitimate JSON Patch clients or REST-exposed repository functionality, so prefer the upgrade.