Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not apply Jackson customizations before forwarding them to Querydsl. This improper access control (CWE-284) could allow unauthorized information disclosure by manipulating filter parameters. The vulnerability affects Spring Data REST versions 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5. There is no vendor advisory or patch information available at this time.

The vulnerability may allow an attacker to bypass intended access controls on data filtering, potentially leading to unauthorized partial disclosure of data. The CVSS score of 5.3 indicates a medium impact with network attack vector, no privileges required, no user interaction needed, and limited confidentiality impact. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to affected endpoints or applying custom filtering logic to validate request parameters before they reach Querydsl. Monitor vendor channels for updates.