Several integration paths in Spring Web Services combined with Spring Security can leak detailed account state information to remote SOAP clients through exception messages or callback outcomes. Instead of generic authentication failure messages, these detailed errors reveal whether an account is locked or disabled, aiding attackers in distinguishing valid user accounts and inferring their lifecycle state. This behavior affects Spring Web Services versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. The vulnerability is identified as CWE-209 and has a CVSS 3.1 base score of 5.3 (medium severity). There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows remote attackers to obtain sensitive information about user account states (e.g., locked or disabled) via error messages in SOAP responses. This information leakage can be used to differentiate valid accounts from invalid ones and infer user lifecycle states, potentially aiding in targeted attacks or reconnaissance. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider configuring the application to suppress detailed error messages in SOAP responses or customize error handling to avoid revealing sensitive account state information.