CVE-2026-41728: Spring Data REST JSON Patch Authorization Bypass

Technical summary

The vulnerability exists in Spring Data REST's JSON Patch processor when handling multi-segment JSON Pointer expressions. JSON Patch operations (add, remove, replace, etc.) can target nested paths like /entity/field/subfield. The framework implements write-access control checks via filters, but these checks are only applied to the final target field, not to intermediate path segments during traversal. An unauthenticated attacker can exploit this by constructing a PATCH request with a path that traverses through protected intermediate objects to reach and modify a writable final segment, bypassing the intended access control model. The issue is classified under CWE-284 (Improper Access Control), reflecting the fundamental authorization enforcement failure.

Business impact

Organizations relying on Spring Data REST for REST API access control face a direct threat to data integrity and confidentiality. If your REST APIs use Spring Data REST to expose sensitive entities with role-based or field-level access restrictions, an unauthenticated attacker can bypass those controls and modify data they should not be able to touch. For financial services, healthcare, or multi-tenant SaaS platforms, this could allow unauthorized modification of customer records, account data, or shared resources. The impact is heightened because the vulnerability requires no authentication and no user interaction, making it trivial to exploit at scale.

Affected systems

All systems running Spring Data REST versions 3.7.0–3.7.19, 4.3.0–4.3.16, 4.4.0–4.4.14, 4.5.0–4.5.11, or 5.0.0–5.0.5 are affected. This includes both Spring Boot applications using Spring Data REST and standalone Spring Data REST deployments. Any REST endpoint that exposes repositories via Spring Data REST and relies on access-control annotations (such as Spring Security's @PreAuthorize or @PostAuthorize on repository methods) may be vulnerable if JSON Patch is enabled and accepted by the framework.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no special privileges, and no user interaction. An attacker needs only a network connection to a vulnerable endpoint and knowledge of the REST API structure. Exploitation is straightforward: send a standard PATCH request with application/json-patch+json content type and a malicious operation targeting a path that traverses protected segments. No CVE-2026-41728 public exploit code or proof-of-concept has been reported yet, but the attack surface is extremely broad for any organization publishing JSON Patch-enabled REST APIs without additional network-level access controls.

Remediation

Upgrade Spring Data REST to a patched version immediately. Verify against the vendor advisory for exact version numbers, but organizations should target the latest available patch within their supported release line. For those unable to patch immediately, consider disabling JSON Patch support in Spring Data REST configuration or implementing additional authentication and authorization layers (e.g., API gateway policies, network segmentation) to restrict access to REST endpoints. Code review of custom RepositoryRestConfigurer implementations may reveal whether JSON Patch has been explicitly enabled or disabled.

Patch guidance

Contact VMware and review the official Spring Data REST security advisory for patch availability and migration steps specific to your version line. Organizations on version 3.7.x, 4.3.x, 4.4.x, 4.5.x, or 5.0.x should consult the vendor's release notes to identify the earliest patched version in their branch. Test patches in a staging environment before production deployment, particularly if your application relies on custom Spring Data REST extensions or repository configurations. Ensure that any automated tooling (dependency scanning, build pipelines) is updated to flag the affected versions.

Detection guidance

Monitor REST endpoint logs for PATCH requests with application/json-patch+json content type, especially those targeting paths with multiple segments (e.g., /api/entity/nested/field). Inspect the operation payloads for suspicious paths that traverse through objects not typically modified by users. Implement logging at the Spring Data REST filter layer or use a Web Application Firewall (WAF) rule set to flag and block JSON Patch requests to sensitive endpoints. Alert on any 200 or 204 responses to PATCH requests that modify fields outside the expected API contract. If you have detailed request logging, look for patterns where paths include multiple levels of object traversal.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS 7.5 (HIGH) rating, zero authentication requirement, ease of exploitation, and direct impact on data integrity. Unlike many high-severity vulnerabilities that require specific preconditions or user action, CVE-2026-41728 can be exploited by any network-connected attacker against any vulnerable endpoint. The broad version footprint (affecting multiple major and minor release lines) means many organizations are likely impacted. Prioritize patching or mitigation for any production REST APIs that expose sensitive data or critical business entities.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The impact is integrity-focused (I:H), allowing modification of data without affecting confidentiality or availability directly. The scope is unchanged (S:U). Organizations with exposed REST APIs accepting JSON Patch requests should treat this as critical. The fact that it is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog does not diminish urgency; early patching reduces the window before public exploits become common.

Frequently asked questions