This vulnerability (CVE-2026-40976) involves missing authorization controls in Spring Boot's default web security configuration. When an application is servlet-based, lacks custom Spring Security configuration, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health, the default security filter chain fails to enforce authorization, enabling unauthorized access to all endpoints. The affected versions are Spring Boot 4.0.0 through 4.0.5. The vendor advisory recommends upgrading to version 4.0.6 or later to remediate the issue.

Exploitation of this vulnerability allows unauthenticated attackers to access all endpoints of affected Spring Boot applications without authorization, potentially leading to full compromise of application data and functionality. The CVSS score of 9.1 reflects the critical nature of the impact, with high confidentiality and integrity impact and no required privileges or user interaction for exploitation.

A fix is available by upgrading affected Spring Boot applications to version 4.0.6 or later as per the vendor advisory. Applications should verify their Spring Security configuration and dependencies to ensure they do not rely solely on the default security filter chain in vulnerable versions. Patch status is confirmed by the vendor advisory recommending the upgrade.