jackson‑databind versions from 2.21.0 up to 2.21.3 and all releases prior to 3.1.4 contain a flaw in the BeanDeserializer routine that causes the @JsonView filter to be applied only to creator properties. Setterless Collection or Map properties that are annotated with @JsonView but lack a setter are processed through an unguarded branch, allowing a malicious JSON payload to populate these otherwise restricted properties, thereby bypassing intended visibility or security controls. This flaw corresponds to CWE‑863 and represents a data‑integrity violation within the application.

The vulnerability affects FasterXML’s jackson‑databind library in versions 2.21.0 through 2.21.3 and in all releases prior to 3.1.4. No other vendors or products are listed.

The CVSS score of 5.3 places the issue in the moderate range. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attack vector is likely remote; any application that accepts externally supplied JSON and uses jackson‑databind for deserialization can be targeted. By crafting a payload that includes a setterless collection or map annotated with a restricted @JsonView, an attacker can inject data that the application believes to be hidden by view filtering. The exploitation requires only normal JSON input and no special privileges, making the risk tangible for services that rely on @JsonView for access control.