jackson-databind EUVD-2026-44506

Exploitation requires three co-occurring application-level conditions: (1) the application uses jackson-databind's ObjectMapper with an active view (mapper.readerWithView() or equivalent) as the primary write-side authorization control; (2) at least one Java property in the deserialized class carries both @JsonView(PrivilegedView.class) and @JsonUnwrapped annotations on the same field or setter; and (3) an attacker-controlled caller can submit JSON to the relevant deserialization endpoint under a less-privileged active view. Exploitation is limited to applications that combine these three patterns - standard usage of @JsonUnwrapped without @JsonView-as-auth-guard is not affected. On jackson-databind 3.x with DEFAULT_VIEW_INCLUSION=false, the exposure requires explicit per-field @JsonView annotations on the inner privileged fields as well. The CVSS-assigned PR:L (authenticated low-privilege user) reflects a conservative estimate; when the consuming endpoint is publicly accessible (e.g., a registration form), no prior authentication is required.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates network-reachable, low-complexity exploitation with high integrity impact and no confidentiality or availability consequence. The GHSA advisory demonstrates a public registration endpoint scenario (PR:N in practice when the endpoint is unauthenticated), suggesting the provided PR:L may be conservative; actual exploitability can depend on whether the consuming application exposes the vulnerable deserialization path to unauthenticated callers. EPSS at 0.42% (34th percentile) and SSVC Exploitation: none signal low current exploitation velocity, contrasting with the POC availability. SSVC Automatable: no reflects that successful exploitation requires attacker knowledge of which specific application properties are @JsonUnwrapped and @JsonView-gated - blind mass-assignment attempts would require reconnaissance. The combination of a publicly available POC, a clear write-side privilege escalation primitive (role escalation, balance manipulation), and widespread library usage elevates real-world risk above what the EPSS score alone suggests, particularly for applications that use @JsonView as their primary deserialization-layer write guard. KEV status is absent, so confirmed active exploitation is not established at time of analysis.

An attacker submits crafted JSON to a self-service registration endpoint that binds the request body using mapper.readerWithView(PublicView.class): fields such as role, approved, and creditBalance - which are annotated @JsonView(AdminView.class) @JsonUnwrapped on the backing AccountFlags object - are silently populated with attacker-supplied values because processUnwrapped() skips the view guard. The result is that the attacker registers as an admin-role, pre-approved user with an arbitrary credit balance without possessing AdminView privileges. A publicly available proof-of-concept reproduces this exact scenario against affected 2.x and 3.x releases.