Spring Data REST includes a JSON Patch implementation that, when resolving a multi-segment JSON Pointer, fails to apply the write-access filter to intermediate segments. The result is that an attacker can modify properties that are intended to be read‑only on nested objects and collections, thereby violating access control and potentially altering sensitive data or configuration settings. The weakness is classified as an access control violation (CWE‑284).

The vulnerability affects Spring:Spring Data REST across several releases: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.

The CVSS score of 7.5 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but based on the description it is inferred that the likely attack vector is remote: a remote attacker can craft a JSON Patch request to a public REST endpoint, supply a JSON Pointer that targets a read‑only property, and the server will apply the change. Because no special conditions are required beyond reaching the endpoint, the likelihood of exploitation is reasonable for exposed services.