Spring Data JPA components accept user‑supplied sort expressions without adequate validation. An attacker can craft payloads that bypass the built‑in check, enabling injection of arbitrary sort clauses. This flaw can lead to unintended data ordering, potential data exfiltration through crafted queries, or other logic bypasses, but does not grant direct code execution.

Affected versions include Spring Data JPA 3.0.0 through 3.4.15, 3.5.0 through 3.5.13, 4.0.0 through 4.0.6, and 4.1.0 across all products from the Spring vendor.

The CVSS score of 4.8 indicates moderate risk. The EPSS score indicates a very low but nonzero exploitation probability; it is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any component that allows users to supply sort parameters over HTTP or other interfaces; exploitation requires access to untrusted input sources. No exploit has been reported publicly, but the absence of a patch or conservative input handling raises the risk for environments that rely on dynamic sorting.