{"id":"spring-security-2d8c1e52e401","seq":2062,"kind":"advisory","title":"cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch","url":"https://spring.io/security/cve-2026-47849","permalink":"https://vulnpulse.app/items/spring-security-2d8c1e52e401","summary":"Spring Data REST does not guard identifier ( @Id ) and version ( @Version ) properties against mutation via RFC 6902 JSON Patch ( application/json-patch+json ) requests. The PUT and merge-patch ( application/merge-patch+json ) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly. Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silent…","severity":"high","techs":["spring","java"],"cves":["CVE-2026-47849"],"tags":["security"],"source":{"id":"spring-security","name":"Spring Security Advisories"},"published_at":"2026-08-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.704Z"}