Spring Data REST processes RFC 6902 JSON Patch requests without protecting the @Id and @Version fields of entities. Because these fields are not constrained during patch processing, an attacker who can send a JSON Patch payload can change an entity’s primary key or its optimistic‑lock version. This flaw directly permits alteration of critical metadata that controls resource identity and concurrency, which can lead to data integrity loss, duplicated records, or potential privilege escalation if identifiers are used for access control. Based on the description, it is inferred that an attacker could exploit this lack of protection to rewrite the identity of an existing resource or bypass concurrency checks.

Versions of Spring Data REST affected by CVE-2026-47849 include 5.1.0, 5.0.0 through 5.0.6, 4.5.0 through 4.5.12, 4.0.0 through 4.4.15, and 3.7.20 and earlier, all supplied by the Spring vendor.

The flaw carries a CVSS score of 7.1, placing it in the medium-high severity range. The EPSS score is < 1%, indicating a very low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploits yet. The attack surface is exposed whenever a JSON Patch endpoint is publicly reachable; an attacker can craft a patch request that targets the identifier or version. Successful exploitation requires only network access to the REST API, and authentication requirements depend on the application’s own security configuration, as the flaw does not introduce new authentication bypass conditions. The likely attack vector is network-based delivery of a malicious JSON Patch payload to a vulnerable REST endpoint.