CVE-2026-47849: Spring Data REST allows mutation of identifier and version properties via JSON Patch
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable/mitigate support for mutating @Id and @Version via application/json-patch+json requests, so RFC 6902 JSON Patch cannot change identifier (@Id) or version (@Version) properties.
Spring Data REST Guard identifier (@Id) and version (@Version) properties against RFC 6902 JSON Patch = disabled
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access to the affected Spring Data REST application and network access to its REST endpoints. No user interaction is required.
Which request type is involved?
The issue is triggered through RFC 6902 JSON Patch requests using the application/json-patch+json content type. It concerns mutation attempts against entity identifier and version properties.
Which versions are affected?
Affected versions are Spring Data REST 5.1.0; 5.0.0 through 5.0.6; 4.5.0 through 4.5.12; 4.0.0 through 4.4.15; and 3.7.20 and earlier.