CVE-2026-47850: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Spring Spring Data REST

Spring Data REST versions 3.7.20 and earlier up to 5.1.0 do not preserve the persisted version (@Version) property of an aggregate root when processing HTTP PUT requests against immutable target types. This improper handling can lead to modification of object attributes that should be controlled, corresponding to CWE-915. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts integrity without affecting confidentiality or availability. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

The vulnerability allows an attacker with low privileges to send crafted HTTP PUT requests that can improperly modify the version property of aggregate roots in Spring Data REST applications. This can lead to integrity issues in the application's data state. There is no impact on confidentiality or availability reported. The medium CVSS score reflects the limited scope and complexity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict HTTP PUT operations on immutable target types in Spring Data REST to prevent unintended modifications. Monitor vendor channels for updates and apply patches promptly once released.