Technical impact
The vulnerability is caused by a missing guard in the Jackson data binding library that allows an attacker to deserialize JSON data containing a property annotated with both @JsonView and @JsonUnwrapped. When, it ignores the visibility guard provided by the active view. This permits an attacker to write data to fields that should be protected by a less‑privileged view, effectively bypassing intended access controls and altering application state or data. The weakness is classified as CWE‑863, which relates to inadequate authorization checks that can lead to privilege escalation or data corruption.
Affected Systems
The flaw affects the FasterXML jackson-databind component. All releases prior to the patch versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 are vulnerable. These include older 2.x releases, the early 3.x releases, and any deployment that has not been updated to a fixed revision.
Risk and Exploitability
The CVSS score of 6.5 denotes a medium to high severity. The EPSS score of less than 1 percent indicates that the exploitation probability is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, if an attacker can supply JSON to the application, they could exploit this weakness by specifically targeting properties with @JsonUnwrapped that also carry a @JsonView annotation, thereby setting data that should be inaccessible under the active view. The attack vector is likely through any endpoint that accepts untrusted JSON input and employs Jackson for deserialization.
Github GHSA