CVE-2026-47849 is a vulnerability in VMware Spring Framework
Published on August 27, 2026
Spring Data REST allows mutation of identifier and version properties via JSON Patch
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.
Spring Data REST 5.1.0
Spring Data REST 5.0.0 - 5.0.6
Spring Data REST 4.5.0 - 4.5.12
Spring Data REST 4.0.0 - 4.4.15
Spring Data REST 3.7.20 and earlier
Vulnerability Analysis
CVE-2026-47849 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and no impact on availability.
Products Associated with CVE-2026-47849
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Data REST:- Version 5.1.0 is affected.
- Version 5.0.0, <= 5.0.6 is affected.
- Version 4.5.0, <= 4.5.12 is affected.
- Version 4.0.0, <= 4.4.15 is affected.
- Before and including 3.7.20 is affected.