CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST fails to protect @Id and @Version properties from mutation via RFC 6902 JSON Patch requests (content type application/json-patch+json). This allows an authenticated user to alter identifier and version fields, leading to high integrity impact (CVSS 3.1: 7.1, AV:N/AC:L/PR:L/UI:N/S...

EUVD-2026-66820

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted @Version property of an aggregate root when handling an HTTP PUT against an immutable target type, allowing mutation of the version field. The issue is rated MEDIUM (CVSS 4.3) with a low integrity impact. Affected versions include 5.1.0 , 5.0.0–5.0...

PT-2026-82348

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT...