What is CVE-2026-47850?

CVE-2026-47850 is a medium-severity vulnerability in Spring Data Rest, classified under CWE-915 IMPROPERLY CONTROLLED MODIFICATION OF DYNAMICALLY-DETERMINED OBJECT ATTRIBUTES. CVSS score: 4.3/10. Published 2026-08-27.

How severe is CVE-2026-47850?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Spring Data Rest

CVE-2026-47850

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Spring Data Rest — versions 5.1.0

References

security@vmware.com

Frequently asked questions

What is CVE-2026-47850?: CVE-2026-47850 is a medium-severity vulnerability in Spring Data Rest, classified under CWE-915 IMPROPERLY CONTROLLED MODIFICATION OF DYNAMICALLY-DETERMINED OBJECT ATTRIBUTES. CVSS score: 4.3/10. Published 2026-08-27.
How severe is CVE-2026-47850?: Medium severity. CVSS v3 base score is 4.3 out of 10.