Spring Data REST does not preserve the @Version property of an aggregate root when an HTTP PUT request is made against an immutable target type. The accepted payload nonetheless updates the version field that is intended to be immutable. An attacker who can send a crafted PUT request can alter the version number of an entity, potentially overwriting recent changes or bypassing optimistic locking controls. The flaw exposes the integrity of persisted data but does not lead to code execution or denial of service. The CVSS score of 4.3 places it in a moderate severity band, indicating a tangible but not critical risk.

The vulnerability affects all versions of Spring Data REST from 5.1.0 down through all releases of the 5.0, 4.5, and 4.0–4.4 series, and every 3.7.20 and earlier release. Systems running any of these versions and exposing PUT endpoints for immutable aggregate roots are potentially affected.

The vulnerability is exploitable via standard HTTP traffic to the REST endpoints that expose immutable aggregates. An attacker must be able to send a valid PUT request to the resource URL, which typically requires network reachability to the service and, depending on the application, may need authorization credentials. The EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Nonetheless, the moderate CVSS score and the ability to modify a critical concurrency control field make the risk significant for data integrity, especially in environments where optimistic locking is relied upon.