Description
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-08
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CopyOperation.apply and MoveOperation.apply in the json-patch library permit copy or move actions without enforcing the necessary access checks. The flaw in src/main/java/com/github/fge/jsonpatch/CopyOperation.java leads to improper control over which JSON nodes can be relocated or duplicated. A remote attacker who can supply arbitrary JSON input can alter protected data structures, potentially reading or deleting sensitive information. This results in a breach of data integrity and confidentiality and is classified as CWE-266 and CWE-284.

Affected Systems

The vulnerability affects the java-json-tools json-patch library up to version 1.13. Any application that includes these older versions and processes untrusted JSON input via the copy or move operations is exposed. The library is open‑source and widely integrated into Java projects, so a large number of software deployments may be affected.

Risk and Exploitability

The CVSS score of 5.3 places this issue in the medium severity range, but the exploitation method is remote and the exploit code is publicly available, increasing practical risk. EPSS data is not provided, so the likelihood estimate is unknown; however, the flaw has been documented in issue trackers and vulnerability databases, and KEV currently lists it as not included. Because the flaw allows unauthorized manipulation of JSON data via external input, systems that expose json‑patch to untrusted sources face significant risk of data tampering.

Generated by OpenCVE AI on September 8, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade json‑patch to the latest released version that contains the access control fix; review the project repository or release notes for the patched release.
  • If an immediate upgrade is not possible, restrict the use of copy and move operations to trusted contexts only; remove or disable these operations from any exposed API surface that accepts untrusted JSON.
  • Audit any application code that invokes json‑patch to ensure that input is authenticated and that proper authorization checks precede copy or move operations; consider adding additional validation or sandboxing around the library.

Generated by OpenCVE AI on September 8, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
First Time appeared Java-json-tools
Java-json-tools json-patch
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:java-json-tools:json-patch:*:*:*:*:*:*:*:*
Vendors & Products Java-json-tools
Java-json-tools json-patch
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Java-json-tools Json-patch
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T02:15:13.531Z

Reserved: 2026-09-07T19:06:36.411Z

Link: CVE-2026-86512

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-08T03:17:19.433

Modified: 2026-09-08T03:17:19.433

Link: CVE-2026-86512

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T03:30:17Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control