## cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

- 種別: advisory
- 関連技術: spring, java, kotlin
- CVE: CVE-2026-47850
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47850)
- パーマリンク: https://vulnpulse.app/items/spring-security-d6a37c854b7d

Spring Data REST does not preserve the persisted version ( @Version ) property of an aggregate root when handling an HTTP PUT against an immutable target type. For mutable aggregates, the PUT merge logic explicitly retains the stored identifier and version properties, discarding any client-supplied values. For immutable aggregates — Java records, Kotlin data classes, all-args @PersistenceCreator types — or when a polymorphic ( @JsonTypeInfo ) subtype change occurs, the merge instead returns the request-body object and restores only Jackson @JsonIgnore -marked properties from storage. The vers…