Spring Data JPA EUVD-2026-66676

Exploitation requires that the target application accepts sort parameters from untrusted sources (e.g., HTTP query parameters) and passes them directly to Spring Data JPA repository query methods, relying on Spring Data JPA's built-in Sort validation as the sole defense without an independent application-layer allowlist. The CVSS AC:H rating confirms that exploitation is not trivial and requires crafting a payload that specifically bypasses the Sort validation mechanism - opportunistic, automated scanning is unlikely to succeed. No authentication is required (PR:N per the provided CVSS vector). Applications that validate or whitelist permitted sort field values at the controller or service layer before invoking repository methods are not exploitable in practice. Exploitation is further limited to affected versions (3.0.0-3.4.15, 3.5.0-3.5.13, 4.0.0-4.0.6, and 4.1.0); upgraded instances are not affected once patched.

The CVSS 4.8 Medium score reflects the bounded nature of this vulnerability: network-accessible and unauthenticated (AV:N/PR:N), but gated by high attack complexity (AC:H) that requires a specifically crafted payload and an application architecture that forwards unsanitized user input to the JPA sort layer. The low confidentiality (C:L) and availability (A:L) impacts cap the worst-case outcome under the base score. No EPSS data was provided, KEV status is negative, and no public exploit code has been identified - all signals consistent with no confirmed active exploitation. However, the 'Authentication Bypass' tag introduces a concern not fully captured by the CVSS vector: if the sort bypass can subvert query-level access control predicates, practical impact could exceed low data enumeration and reach unauthorized data exposure, which would warrant treating this closer to a High-severity issue. Any organization running Spring Boot applications that expose dynamic sort parameters - even a small development shop - should treat this as an urgent patch priority given the breadth of the affected version range (3.0.0 through 4.1.0) and the ubiquity of the Spring Data JPA ecosystem. The AC:H rating does limit opportunistic, automated exploitation, reducing mass-exploitation risk but not eliminating targeted attack scenarios.

An unauthenticated attacker targeting a Spring Boot application that accepts HTTP sort parameters (e.g., ?sort=name,asc) and passes them without independent validation to a Spring Data JPA repository sends a crafted payload designed to bypass the Sort validation logic, injecting an arbitrary ordering expression into the resulting JPA query. Depending on the application's query structure and access control implementation, this may expose data ordering patterns, trigger unexpected query behavior causing partial availability degradation, or in configurations where the 'Authentication Bypass' tag applies, subvert query-level access predicates. No public exploit code has been identified at time of analysis.