CVE-2026-47850CWE-915

CVE-2026-47850

Medium · published August 27, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.

Spring Data REST 5.1.0

Spring Data REST 5.0.0 - 5.0.6

Spring Data REST 4.5.0 - 4.5.12

Spring Data REST 4.0.0 - 4.4.15

Spring Data REST 3.7.20 and earlier

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-08-27T05:17Z
Affected products (5)
ProductVersionsFixed in
vmware/spring_data_rest< 3.7.213.7.21
vmware/spring_data_rest≥ 4.0.0, < 4.4.164.4.16
vmware/spring_data_rest≥ 4.5.0, < 4.5.134.5.13
vmware/spring_data_rest≥ 5.0.0, < 5.0.6.15.0.6.1
vmware/spring_data_rest≥ 5.1.0, < 5.1.0.15.1.0.1
References (1)
https://spring.io/security/cve-2026-47850 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 26 AUG 23:28Z
    Spring Data REST allows mutation of the version property of immutable aggregates via PUT
    cvelistv5