A flaw in Spring Expression Language evaluation permits attackers to trigger zero‑argument method calls even when evaluation occurs inside read‑only or restricted contexts. The flaw effectively bypasses intended authorization checks, allowing unintended application logic to execute. This is an authorization issue classified as CWE‑863 and CWE‑917, and can result in privilege escalation or undesired behavior within the application.

Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are affected. All deployments of these releases that accept SpEL expressions from untrusted sources are potentially vulnerable.

The CVSS score is 3.7, indicating a low overall severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity so far. The likely attack vector is through any component that evaluates SpEL expressions supplied by an attacker; however, the precise conditions required to trigger exploitation are not explicitly detailed in the advisory. Given the low risk rating, the threat remains modest but still exploitable if the application processes untrusted SpEL input.