CVE-2026-47849CWE-915

CVE-2026-47849

High · published August 27, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.

Spring Data REST 5.1.0

Spring Data REST 5.0.0 - 5.0.6

Spring Data REST 4.5.0 - 4.5.12

Spring Data REST 4.0.0 - 4.4.15

Spring Data REST 3.7.20 and earlier

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-08-27T10:17Z
Affected products (5)
ProductVersionsFixed in
vmware/spring_data_rest< 3.7.213.7.21
vmware/spring_data_rest≥ 4.0.0, < 4.4.164.4.16
vmware/spring_data_rest≥ 4.5.0, < 4.5.134.5.13
vmware/spring_data_rest≥ 5.0.0, < 5.0.6.15.0.6.1
vmware/spring_data_rest≥ 5.1.0, < 5.1.0.15.1.0.1
References (1)
https://spring.io/security/cve-2026-47849 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 27 AUG 05:06Z
    Spring Data REST allows mutation of identifier and version properties via JSON Patch
    cvelistv5