Cloudanix VulnDB

CVE-2026-59889

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Jul 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A data-handling library used by many applications failed to properly restrict which information could be changed by users with limited permissions, allowing attackers to alter fields they should not access.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing view visibility check in UnwrappedPropertyHandler.processUnwrapped() allows attacker-controlled JSON to deserialize into a @JsonUnwrapped property that is also annotated with @JsonView, bypassing the active view guard and writing data under a less-privileged view.

Why it matters to the business

Attackers with limited privileges can modify data fields they should not reach, potentially escalating access or corrupting application state in any system using the affected Jackson versions for JSON handling.

How an attack unfolds

An attacker identifies an endpoint that deserializes JSON under an active @JsonView, crafts a payload containing a nested structure targeting a @JsonUnwrapped property also marked with @JsonView, and sends the request; the library replays the buffered content without checking ctxt.getActiveView(), causing the property to be set regardless of view restrictions.

How to fix it

Upgrade jackson-databind to 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 (or newer) in all components. Rebuild and redeploy applications after the upgrade; verify no custom UnwrappedPropertyHandler overrides bypass the view check.

How to confirm the fix worked

Confirm the runtime classpath contains a fixed jackson-databind jar version; run unit tests that exercise @JsonView + @JsonUnwrapped combinations under multiple views and assert that unauthorized fields remain unset.

Typical attack path

  1. Identify a JSON-accepting endpoint that applies @JsonView during deserialization
  2. Locate a model class containing a field annotated with both @JsonUnwrapped and @JsonView
  3. Craft a JSON payload that supplies values for the unwrapped nested properties
  4. Send the request under a low-privilege active view
  5. Observe successful population of the protected fields

How to detect it

Review application logs for Jackson deserialization events around the time of suspect requests; look for JSON payloads containing nested objects that map to @JsonUnwrapped fields while the active view context is recorded in debug traces.

What your security team should do

  • Prioritize upgrade of jackson-databind in all services within the next sprint given 104 days since disclosure
  • Scan dependency trees for any transitive usage of versions 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, 3.1.0-3.1.4, or 3.2.0
  • Add automated dependency checks to CI pipelines to block future vulnerable versions
  • Review all models using @JsonUnwrapped together with @JsonView for unnecessary exposure

The record

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities