cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier ( @Id ) and version ( @Version ) properties against mutation via RFC 6902 JSON Patch ( application/json-patch+json ) requests. The PUT and merge-patch ( application/merge-patch+json ) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly. Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silent…

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Spring、Java。CVE: CVE-2026-47849。