CVE-2026-41728 is an improper access control vulnerability (CWE-284) in Spring Data REST's JSON Patch (application/json-patch+json) implementation. The issue arises because the write-access filter is not enforced on intermediate path segments during the resolution of multi-segment JSON Pointers. This flaw could allow an attacker to perform unauthorized write operations on parts of the REST resource that should be protected. The vulnerability affects multiple version ranges of Spring Data REST: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported as of the published date.

An attacker can exploit this vulnerability to bypass write-access controls on intermediate path segments in JSON Patch requests, potentially modifying protected data without proper authorization. The CVSS score of 7.5 (high severity) reflects the ease of network exploitation without privileges or user interaction and the impact on integrity. Confidentiality and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected Spring Data REST endpoints and carefully validate JSON Patch requests to mitigate unauthorized modifications. Monitor vendor channels for updates and patches addressing this vulnerability.