Threat Intelligence Database

CVE-2026-59889 is an authorization bypass vulnerability in FasterXML jackson-databind affecting versions prior to 2.21.5, 2.22.1, 3.1.5, and 3.2.1. It occurs because the processUnwrapped() method does not enforce the @JsonView authorization guard on container properties annotated with @JsonUnwrapped, allowing attacker-controlled JSON to overwrite privileged fields under a more restrictive view. This can lead to write-side mass-assignment and privilege escalation, such as an attacker assigning themselves admin roles or elevated privileges. The issue affects both 2.x and 3.x branches and variants including nested unwrapped properties and builder-based deserializers. A patch is available that adds the missing view guard to processUnwrapped(), closing all known bypass variants.

A vulnerability in FasterXML jackson-databind versions from 2.15.0 up to but not including 2.18.8, 2.21.4, and 3.1.4 allows Java Records using a PropertyNamingStrategy to bypass the @JsonIgnore annotation. This occurs because the ignored component is recorded under its original name before the naming strategy renames the JSON key, enabling assignment to the Record constructor parameter. The issue is fixed starting from versions 2.18.8, 2.21.4, and 3.1.4.