Spring Data REST’s Querydsl integration accepts arbitrary persistent property paths as filter keys without respecting Jackson customizations that hide certain fields. This oversight enables an attacker to request data fields that should be hidden, potentially exposing sensitive internal data. The flaw is rooted in improper access control (CWE‑284) and can let attackers learn more about the application’s data model than intended.

Affected are Spring Data REST releases 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5. Users of these versions that expose REST endpoints powered by Querydsl are impacted.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA KEV catalog. The attack can be performed via an HTTP request to a REST endpoint, by supplying an arbitrary filter key that maps to a hidden property. Successful exploitation would read otherwise protected data, affecting confidentiality of the application’s information resources.