Spring Cloud Commons exposes a writable /actuator/env endpoint without enforcing an allow list for property keys. This flaw permits any request that can reach the endpoint to modify environment properties at runtime, potentially changing application behavior. No other mechanisms such as authentication or authorization checks are applied to restrict which properties can be updated.

Versions of Spring Cloud Commons from 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, 4.0.0 through 4.2.6, and all releases 3.1.10 and earlier are impacted by this issue.

The CVSS base score of 6.6 reflects a moderate to high impact. Exploitation requires that the /actuator/env endpoint be reachable and writable; it is inferred that an external attacker who can contact the endpoint could supply arbitrary key/value pairs. The EPSS score is < 1%, which is less than 1% and indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. No evidence indicates that the attacker must have higher privileges within the application, so the impact is confined to the permissions granted to the writable endpoint.