CVE-2026-47849: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Spring Spring Data REST

Spring Data REST does not properly guard identifier (@Id) and version (@Version) properties against mutation when processing RFC 6902 JSON Patch (application/json-patch+json) requests. This weakness, classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), allows an attacker with at least low privileges to modify critical object attributes that should be immutable, potentially compromising data integrity. The vulnerability affects multiple versions of Spring Data REST up to and including 5.1.0. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with the ability to send JSON Patch requests can modify identifier and version properties that are normally immutable. This can lead to unauthorized changes in object identity and versioning, potentially causing data integrity issues and impacting application logic that relies on these properties. The CVSS score of 7.1 (high) reflects the potential for significant impact on confidentiality and integrity without requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to JSON Patch endpoints to trusted users only and monitor for suspicious modification attempts. Avoid exposing sensitive identifier and version properties to modification via JSON Patch if possible.