This vulnerability in java-json-tools json-patch (up to version 1.13) involves improper access controls in the CopyOperation.apply and MoveOperation.apply methods within the Copy Move Operations component. The flaw allows remote attackers to exploit these functions to bypass intended access restrictions. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Although the issue was reported early, no official remediation or patch has been released, and public exploit code exists.

Exploitation of this vulnerability can lead to unauthorized access or manipulation of JSON data via the affected copy and move operations. This could compromise data integrity or confidentiality depending on the application context. The vulnerability is remotely exploitable with low complexity and minimal privileges, increasing the risk of unauthorized actions within affected systems.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting access to services using the vulnerable versions of json-patch and applying additional access controls at the application or network level to limit exposure.