This vulnerability affects Spring Security versions 7.0.0 through 7.0.4. When an application configures authorization rules using <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/>, the servlet path component is omitted from the path matcher calculation. As a result, the intended authorization checks are not enforced, potentially allowing unauthorized users to access restricted resources. The issue is classified under CWE-284 (Improper Access Control). The CVSS v3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass authorization controls on affected Spring Security applications that use the vulnerable servlet-path configuration. This can lead to unauthorized modification or manipulation of protected resources (high integrity impact). There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and avoid using the <sec:intercept-url> configuration with the servlet-path attribute as described, or implement additional access control checks outside of this mechanism to mitigate the risk.