This vulnerability in Spring Framework's SpEL evaluation logic permits arbitrary invocation of zero-argument methods even within contexts intended to be restricted or read-only. This incorrect authorization (CWE-863) could allow attackers to execute unintended application logic. The issue affects multiple Spring Framework versions spanning 5.3.0 to 7.0.7. The CVSS 3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and no confidentiality or integrity impact but low availability impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows attackers to invoke arbitrary zero-argument methods via SpEL in contexts that should restrict such actions. While this does not directly impact confidentiality or integrity, it may cause low availability impact by triggering unintended application logic. The overall severity is low based on the CVSS score and described impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring Framework advisories for updates. Until a patch is available, consider reviewing and restricting SpEL usage in sensitive contexts to minimize exposure.