This vulnerability (CWE-653) in Spring gRPC occurs because the authenticated identity is not properly cleared from the gRPC worker thread after an authenticated user is denied access to a method. Consequently, the identity can be inherited by a subsequent unauthenticated request processed on the same thread, potentially leading to privilege escalation. Affected versions are 1.0.0 through 1.0.2, with the issue resolved in 1.0.3. The CVSS v3.1 score is 4.3, indicating medium severity. No vendor advisory or patch links are provided, and the remediation level is unspecified.

The vulnerability allows a subsequent unauthenticated user to inherit the identity of a previously authenticated user on the same gRPC worker thread after access denial, potentially resulting in unauthorized privilege escalation. The impact is limited to confidentiality and integrity with no availability impact reported. The CVSS score reflects a medium severity risk due to the need for low privileges to exploit and the requirement for network access with high attack complexity.

A fix is available in Spring gRPC version 1.0.3. Users should upgrade to this version or later to remediate the vulnerability. Since no official vendor advisory or patch links are provided, verify the upgrade and patch status with the Spring project resources. Until upgraded, consider restricting access to affected versions and monitor for suspicious activity related to gRPC authentication contexts.