## cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch

- 種別: advisory
- 重大度: high
- 関連技術: spring, java
- CVE: CVE-2026-47849
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47849)
- パーマリンク: https://vulnpulse.app/items/spring-security-2d8c1e52e401

Spring Data REST does not guard identifier ( @Id ) and version ( @Version ) properties against mutation via RFC 6902 JSON Patch ( application/json-patch+json ) requests. The PUT and merge-patch ( application/merge-patch+json ) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly. Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silent…