CVE-2026-86512: java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected component is java-json-tools json-patch through version 1.13, specifically its CopyOperation.apply and MoveOperation.apply handling for copy and move operations. The provided data identifies the Maven artifact as com.github.fge.json-patch:json-patch.
What access does an attacker need?
The listed vector indicates network-reachable exploitation with low attack complexity, no user interaction, and low privileges required. Exploitation is therefore not described as unauthenticated; the attacker needs some level of privileges.
Is public exploitation information available?
Yes. The exploit is described as publicly available and potentially usable.
Is a vendor fix available?
The provided information does not identify a fixed version or a patch. It states that the project was notified through an issue report but had not responded at the time of the report.