Spring HATEOAS's PropertyUtils.createObjectFromProperties method, used by Collection+JSON and UBER media type deserializers, performs bean property binding through reflection but does not consult Jackson access-control annotations. This results in improper access control (CWE-284), potentially allowing attackers to manipulate internal object properties in unintended ways. The vulnerability affects multiple version ranges: 1.5.0 to 1.5.6, 2.3.0 to 2.3.4, 2.4.0 to 2.4.1, 2.5.0 to 2.5.2, and 3.0.0 to 3.0.3. The CVSS v3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). There is no known exploit in the wild and no official remediation level or patch has been published as of now.

The vulnerability allows attackers to bypass access control checks during bean property binding, which can lead to denial of service conditions. Confidentiality and integrity impacts are not indicated. The attack can be performed remotely without authentication or user interaction. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations or workarounds are provided in the available data.