Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not respect Jackson customizations before handing them to Querydsl. This improper access control (CWE-284) could allow unauthorized access to data by manipulating filter parameters. The vulnerability affects versions 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5 of Spring Data REST. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows attackers to bypass intended access controls by supplying arbitrary property paths in filter parameters, potentially exposing sensitive data. The impact is limited to confidentiality (partial data disclosure) without integrity or availability impact. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is provided, users should monitor for updates from Spring and consider restricting or validating filter parameters in the interim to mitigate unauthorized data exposure.