CVE-2026-54518: Jackson-databind Authorization Bypass in Unwrapped Creator Properties

Technical summary

The vulnerability resides in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which deserializes unwrapped JSON properties into constructor parameters without validating the active view context. While the standard property-based creator path invokes prop.visibleInView(activeView) to enforce JSON view filtering, the unwrapped-creator replay path omits this check. A constructor parameter decorated with both @JsonUnwrapped and @JsonView(AdminView.class) will be deserialized even when a less-privileged view (e.g., UserView) is active. The vulnerability is classified as CWE-863 (Incorrect Authorization) and carries a CVSS 3.1 score of 6.5 (MEDIUM), indicating medium network-based impact with no user interaction required.

Business impact

Organizations using Jackson-databind for REST APIs or microservices with role-based or view-based access controls may face unauthorized data modification. An attacker can bypass application-level authorization logic by injecting JSON into admin-only constructor fields, potentially escalating privileges, modifying sensitive configuration, or corrupting data that should be write-restricted. The risk is highest in multi-tenant systems or applications that rely on @JsonView annotations to enforce API response or request boundaries between user roles.

Affected systems

Jackson-databind versions 2.21.0 through 2.21.3 and version 3.1.3 are vulnerable. The 2.21.x line is in active use across many enterprise Java applications; 3.1.3 is the newest affected version. Applications that depend on jackson-databind indirectly through frameworks like Spring Boot, Quarkus, or Micronaut may also be affected. Check your build artifacts and dependency trees for these versions.

Exploitability

Exploitability is straightforward for attackers with network access. No special privileges, authentication, or user interaction are required; the attack is triggered by crafting and sending a JSON request to a vulnerable endpoint. The vulnerability is reliable and does not depend on race conditions or timing. An attacker needs only to identify endpoints that deserialize JSON into objects with the vulnerable pattern (constructor parameters using both @JsonUnwrapped and @JsonView annotations), then include the admin-only field in the JSON payload.

Remediation

Upgrade Jackson-databind to version 2.21.4 or later (for the 2.21.x branch) or to version 3.1.4 or later (for the 3.1.x branch). Verify the upgrade by checking your dependency lock file or by running a build and confirming the patched version is in use. If immediate upgrade is not possible, review all @JsonUnwrapped constructor parameters to confirm they do not also carry @JsonView annotations; if they do, refactor to avoid that combination until patching is complete.

Patch guidance

Apply the upgrade from your package manager (Maven Central, Gradle repository, etc.) to 2.21.4 or 3.1.4. No configuration changes are required post-upgrade. Test deserialization of JSON payloads that target constructor parameters with @JsonUnwrapped and @JsonView to ensure the view restrictions are now enforced. Consult the Jackson project release notes (verify against the vendor advisory) for any additional changes or deprecations in the patch.

Detection guidance

Monitor build and dependency files for jackson-databind versions 2.21.0–2.21.3 or 3.1.3. Use Software Composition Analysis (SCA) tools to flag these versions in your repositories and CI/CD pipelines. In application code, search for constructors that combine @JsonUnwrapped with @JsonView annotations; these are the highest-risk patterns and should be prioritized for testing post-upgrade. Monitor API traffic for suspicious JSON payloads that attempt to set admin-only fields in requests that should be subject to view restrictions.

Why prioritize this

This vulnerability requires timely attention because it directly undermines authorization controls in Jackson-deserializing applications. While the CVSS score is medium (6.5), the real-world impact is high when applications depend on @JsonView for security boundaries. No active exploitation is recorded in the public domain yet (not in KEV), but the vulnerability is trivial to exploit and affects widely-deployed code. Prioritize applications that accept untrusted JSON and enforce role-based access control.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible, unauthenticated attack with low attack complexity. The integrity impact is rated as LOW because the attacker can modify data fields, but not all fields (only those in the unwrapped creator path). Confidentiality is also rated LOW, as some data exposure may occur. No availability impact is recorded. The score appropriately captures the authorization bypass but may understate real-world risk in security-sensitive applications where @JsonView protections are critical to the threat model.

Frequently asked questions