Spring Data REST JSON Patch Identifier Mutation Flaw

Spring Data REST versions 3.7.20 and earlier through 5.1.0 fail to properly validate RFC 6902 JSON Patch requests, allowing attackers to mutate protected @Id and @Version properties on entities. This vulnerability is particularly dangerous because identifier and version fields are fundamental to data integrity and access control—modifying them can lead to unauthorized data access, object tampering, privilege escalation, or denial of service. Any organization using affected Spring Data REST versions to expose REST endpoints is vulnerable, especially those handling sensitive data where entity identifiers serve as authorization boundaries.

While this CVE currently lacks mapped MITRE ATT&CK techniques, Casky's AI-driven analysis would detect the attack patterns underlying this vulnerability by examining API request manipulation and data modification behaviors. A practitioner using Casky would identify suspicious JSON Patch payloads attempting to modify @Id/@Version fields through anomalous REST endpoint activity, unauthorized data mutations, and object state changes that violate expected entity immutability. By correlating these behavioral indicators with 754 mapped security skills, Casky would surface exploitation attempts, help teams distinguish legitimate patch operations from malicious ones, and provide context on the data manipulation techniques adversaries use to compromise application data integrity—enabling detection before attackers exploit identifier mutations for lateral movement or privilege escalation.