CVE-2026-54518

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Incorrect Authorization pada fasterxml jackson-databind. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962 advisory vendor
• https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341 patch
• https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea patch
• https://github.com/FasterXML/jackson-databind/pull/5971 issue tracking
• https://github.com/FasterXML/jackson-databind/pull/5973 issue tracking