CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST fails to protect @Id and @Version properties from mutation via RFC 6902 JSON Patch requests (content type application/json-patch+json). This allows an authenticated user to alter identifier and version fields, leading to high integrity impact (CVSS 3.1: 7.1, AV:N/AC:L/PR:L/UI:N/S...

EUVD-2026-66820

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted @Version property of an aggregate root when handling an HTTP PUT against an immutable target type, allowing mutation of the version field. The issue is rated MEDIUM (CVSS 4.3) with a low integrity impact. Affected versions include 5.1.0 , 5.0.0–5.0...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

PT-2026-82348

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.20 and earlier Spring Data REST versions 4.0.0 through 4.4.15 Spring Data REST versions 4.5.0 through 4.5.12 Spring Data REST versions 5.0.0 through 5.0.6 Spring Data REST version 5.1.0 Description An issue exists...

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT...

Improper Enforcement of Behavioral Workflow

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the handling of HTTP PUT requests against immutable aggregate types. An attacker can bypass optimistic-locking...