Threats Tagged 'ghsa-5gvw-p9qm-jgwh'

CVE-2026-59889 is an authorization bypass vulnerability in FasterXML jackson-databind affecting versions prior to 2.21.5, 2.22.1, 3.1.5, and 3.2.1. It occurs because the processUnwrapped() method does not enforce the @JsonView authorization guard on container properties annotated with @JsonUnwrapped, allowing attacker-controlled JSON to overwrite privileged fields under a more restrictive view. This can lead to write-side mass-assignment and privilege escalation, such as an attacker assigning themselves admin roles or elevated privileges. The issue affects both 2.x and 3.x branches and variants including nested unwrapped properties and builder-based deserializers. A patch is available that adds the missing view guard to processUnwrapped(), closing all known bypass variants.