Apache Commons BeanUtils versions before 1.11.0 (1.x) and before 2.0.0-M2 (2.x) contain an improper access control vulnerability. This flaw allows attackers to access the class loader of Java enum objects via the 'declaredClass' property when property paths from external sources are passed directly to PropertyUtilsBean's getProperty() or getNestedProperty() methods. The vulnerability is fixed by default starting in versions 1.11.0 and 2.0.0-M2 by suppressing access to the 'declaredClass' property through a special BeanIntrospector.