This vulnerability in Spring Framework's SpEL evaluation logic permits arbitrary zero-argument method invocation within contexts that are intended to be restricted or read-only. It affects Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability (low). There is no vendor advisory or patch information provided, and no known exploits have been reported.

The vulnerability allows an attacker to invoke arbitrary zero-argument methods via SpEL in contexts that should be restricted or read-only. While this could lead to unintended application logic execution, the CVSS score and vector indicate limited impact, primarily a low availability impact. There is no indication of confidentiality or integrity compromise. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Spring Framework advisories for updates. No specific mitigation steps are provided in the available data.