jackson-databind contains a flaw where unwrapped creator parameters annotated with @JsonView and @JsonUnwrapped are populated from incoming JSON regardless of the active view, bypassing the intended visibility restrictions. This allows an attacker to obtain data that should have been hidden, leading to unauthorized information disclosure. The weakness is classified as CWE‑863, reflecting an authorization bypass through user‑controlled keys.

The vulnerability affects FasterXML jackson-databind versions 2.21.0 through 2.21.3 and any releases prior to 3.1.4. The fix is included in jackson-databind 2.21.4 and 3.1.4 (and later). Systems using these libraries for JSON deserialization are at risk when “@JsonUnwrapped” is combined with “@JsonView”.

The CVSS score of 6.5 indicates a medium severity. EPSS is not available, but the lack of a KEV listing suggests no widely known active exploits yet. The vulnerability can be triggered by crafting JSON payloads that include unwrapped properties; the deserialization process will deserialize them into constructor parameters without enforcing view visibility, potentially exposing sensitive data. The attack requires the attacker to supply a JSON document to an application that uses the vulnerable deserialization path, and succeeds even when a more restrictive view is activated.