7.1High
CVE-2026-47849Spring Data REST allows mutation of identifier and version properties via JSON Patch
Description
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Weakness (CWE):
CWE-915
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Spring | Spring Data REST | 5.1.0, 5.0.0 – ≤ 5.0.6, 4.5.0 – ≤ 4.5.12, 4.0.0 – ≤ 4.4.15, ≤ 3.7.20 | |
| vmware | spring data rest | < 3.7.21 |
References and patches
- https://spring.io/security/cve-2026-47849 Vendor Advisory
CPE matches (NVD) (5)
cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*< 3.7.21cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.4.16cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.13cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.6.1cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 5.1.0 < 5.1.0.1