This vulnerability affects Spring Security versions from 7.0.0 through 7.0.4. When an application uses securityMatchers(String) along with a PathPatternRequestMatcher.Builder bean to prepend a servlet path, the filter chain may fail to match requests correctly. Consequently, the security components such as authentication and authorization controls may not be exercised on those requests, effectively rendering them inactive. This can lead to unauthorized access or bypass of intended security controls. The CVSS 3.1 base score is 7.5 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability can cause security controls including authentication and authorization to be bypassed on certain requests due to improper filter chain matching. This can lead to unauthorized actions or access within applications using the affected Spring Security versions. The integrity of the application is at risk, but confidentiality and availability are not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review application configurations that use securityMatchers(String) and PathPatternRequestMatcher.Builder to ensure that security filters are correctly applied. Avoid relying on these constructs if possible or implement additional access controls to compensate. Monitor vendor channels for updates and apply patches promptly once available.