CVE-2025-41248

What it actually does

The flaw allows authorization bypass because Spring Security's annotation detection fails to resolve @PreAuthorize and similar annotations on methods in type hierarchies involving parameterized super types with unbounded generics when @EnableMethodSecurity is active.

Why it matters to the business

Attackers may gain unauthorized access to protected application functions and data, increasing exposure risk for sensitive operations until fixed.

How an attack unfolds

An attacker identifies endpoints protected by method security annotations placed on methods within generic superclasses or interfaces, then invokes those methods directly; the flawed detection skips the authorization check, granting access that should have been denied.

How to fix it

Upgrade Spring Security to a version that correctly resolves annotations across generic type hierarchies; avoid placing security annotations on methods in generic superclasses or interfaces until updated.

How to confirm the fix worked

Audit code using @EnableMethodSecurity for annotations on generic hierarchies, then verify authorization enforcement with targeted tests after applying updates.

Typical attack path

1. Map application endpoints using @EnableMethodSecurity
2. Locate methods inheriting security annotations from parameterized generic super types
3. Send requests targeting those methods without required credentials or roles
4. Bypass authorization and access restricted functionality

How to detect it

Review application logs for authorization decisions around methods in generic hierarchies and monitor for access patterns that bypass expected permission checks.

What your security team should do

• Determine whether @EnableMethodSecurity is enabled and if annotations exist on generic super types
• Prioritize patching once fixed releases are available given the authorization bypass nature
• Temporarily refactor affected methods to non-generic locations if immediate upgrade is not feasible