Spring HATEOAS versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3 contain an improper access control vulnerability (CWE-284) in the PropertyUtils.createObjectFromProperties method. This method, used by the Collection+JSON and UBER media type deserializers, binds bean properties via reflection but does not consult Jackson access-control annotations, potentially allowing unintended property manipulation. The CVSS 3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability. No vendor advisory or patch information is currently available.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service (availability impact) due to improper access control in property binding. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating exposure by restricting access to affected services or disabling the use of vulnerable media type deserializers if feasible. Monitor vendor channels for updates.