CVE-2026-47892: CWE-863 Incorrect Authorization in Spring Spring Framework

This vulnerability (CWE-863) in Spring Framework versions 5.2.5.RELEASE through 7.0.8 allows an attacker to bypass header predicate checks in pre-flight requests within WebFlux applications using functional endpoints deployed with DispatcherServlet. This incorrect authorization flaw can be exploited remotely without authentication, resulting in high impact on confidentiality, integrity, and availability as indicated by a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization controls in affected Spring Framework applications, potentially leading to full compromise of sensitive data, unauthorized actions, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review application configurations involving WebFlux functional endpoints and DispatcherServlet deployment to identify potential exposure. Monitor vendor channels for updates and apply patches promptly once available.