CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.
Your application may be affected by this if the following are true:
You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization.
You are not affected if:
You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or You have no Spring Security-annotated private methods
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41232?
CVE-2025-41232 is classified as a high severity vulnerability due to the potential for authorization bypass.
How do I fix CVE-2025-41232?
To fix CVE-2025-41232, ensure that method security annotations are correctly applied to methods and consider adjusting your configuration to avoid private method access issues.
What impact does CVE-2025-41232 have on my application?
CVE-2025-41232 could lead to unauthorized access as the security aspects may fail to enforce method security on private methods.
Which versions of Spring Security are affected by CVE-2025-41232?
CVE-2025-41232 affects VMware Spring Security configurations that utilize @EnableMethodSecurity(mode=ASPECTJ) for method authorization.
Is CVE-2025-41232 actively being exploited?
As of now, there have been no reported active exploits for CVE-2025-41232, but it is advisable to apply mitigations as a precaution.