CVE-2026-59889: CWE-863: Incorrect Authorization in FasterXML jackson-databind
CVE-2026-59889 is an authorization bypass vulnerability in FasterXML jackson-databind affecting versions prior to 2.21.5, 2.22.1, 3.1.5, and 3.2.1. It occurs because the processUnwrapped() method does not enforce the @JsonView authorization guard on container properties annotated with @JsonUnwrapped, allowing attacker-controlled JSON to overwrite privileged fields under a more restrictive view. This can lead to write-side mass-assignment and privilege escalation, such as an attacker assigning themselves admin roles or elevated privileges. The issue affects both 2.x and 3.x branches and variants including nested unwrapped properties and builder-based deserializers. A patch is available that adds the missing view guard to processUnwrapped(), closing all known bypass variants.
AI Analysis
Technical Summary
The vulnerability arises from the processUnwrapped() method in jackson-databind not applying the visibleInView() guard when deserializing properties annotated with both @JsonView and @JsonUnwrapped. This omission allows attacker JSON to bypass the intended write-side authorization restrictions enforced by @JsonView on container properties, enabling mass-assignment of privileged fields even under restrictive active views. The flaw was confirmed in versions 2.x (including 2.21.4 and 2.22.0 lines) and 3.x (latest 3.x HEAD), with the default view inclusion configuration influencing the exploitability. Variants including nested unwrapped properties, partial updates via merge, and builder-based deserializers are also affected. The fix involves adding the visibleInView() check in processUnwrapped(), consistent with protections applied in other deserialization paths.
Potential Impact
This vulnerability allows an attacker with the ability to submit JSON input to bypass write-side authorization controls implemented via @JsonView annotations on container properties that are @JsonUnwrapped. This can result in privilege escalation by mass-assigning sensitive fields such as roles, approval status, or credit balances that should be restricted to privileged views. The impact is primarily on data integrity (high), with no confidentiality or availability impact reported. The vulnerability undermines the intended access control model in applications using jackson-databind for JSON deserialization with view-based authorization.
Mitigation Recommendations
A patch is available that addresses this vulnerability by adding the missing visibleInView() guard in the processUnwrapped() method. Users should upgrade to jackson-databind versions 2.21.5 or later, 2.22.1 or later, 3.1.5 or later, or 3.2.1 or later to remediate this issue. Until patched, applications should review their use of @JsonUnwrapped combined with @JsonView for write-side authorization and consider additional application-level controls to prevent unauthorized mass-assignment. No vendor advisory content contradicts this guidance.
CVE-2026-59889: CWE-863: Incorrect Authorization in FasterXML jackson-databind
Description
CVE-2026-59889 is an authorization bypass vulnerability in FasterXML jackson-databind affecting versions prior to 2.21.5, 2.22.1, 3.1.5, and 3.2.1. It occurs because the processUnwrapped() method does not enforce the @JsonView authorization guard on container properties annotated with @JsonUnwrapped, allowing attacker-controlled JSON to overwrite privileged fields under a more restrictive view. This can lead to write-side mass-assignment and privilege escalation, such as an attacker assigning themselves admin roles or elevated privileges. The issue affects both 2.x and 3.x branches and variants including nested unwrapped properties and builder-based deserializers. A patch is available that adds the missing view guard to processUnwrapped(), closing all known bypass variants.
CVSS v3.1
Score 6.5medium
Affected software
pkg:maven/com.fasterxml.jackson.core/jackson-databindRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the processUnwrapped() method in jackson-databind not applying the visibleInView() guard when deserializing properties annotated with both @JsonView and @JsonUnwrapped. This omission allows attacker JSON to bypass the intended write-side authorization restrictions enforced by @JsonView on container properties, enabling mass-assignment of privileged fields even under restrictive active views. The flaw was confirmed in versions 2.x (including 2.21.4 and 2.22.0 lines) and 3.x (latest 3.x HEAD), with the default view inclusion configuration influencing the exploitability. Variants including nested unwrapped properties, partial updates via merge, and builder-based deserializers are also affected. The fix involves adding the visibleInView() check in processUnwrapped(), consistent with protections applied in other deserialization paths.
Potential Impact
This vulnerability allows an attacker with the ability to submit JSON input to bypass write-side authorization controls implemented via @JsonView annotations on container properties that are @JsonUnwrapped. This can result in privilege escalation by mass-assigning sensitive fields such as roles, approval status, or credit balances that should be restricted to privileged views. The impact is primarily on data integrity (high), with no confidentiality or availability impact reported. The vulnerability undermines the intended access control model in applications using jackson-databind for JSON deserialization with view-based authorization.
Mitigation Recommendations
A patch is available that addresses this vulnerability by adding the missing visibleInView() guard in the processUnwrapped() method. Users should upgrade to jackson-databind versions 2.21.5 or later, 2.22.1 or later, 3.1.5 or later, or 3.2.1 or later to remediate this issue. Until patched, applications should review their use of @JsonUnwrapped combined with @JsonView for write-side authorization and consider additional application-level controls to prevent unauthorized mass-assignment. No vendor advisory content contradicts this guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T16:40:07.983Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a569d2168715ace43280ecb
Added to database: 07/14/2026, 20:33:37 UTC
Last enriched: 08/03/2026, 21:22:23 UTC
Last updated: 08/27/2026, 04:09:39 UTC
Views: 366
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.