Spring Security Authorization Bypass: High Severity Vulnerability

The National Vulnerability Database has disclosed CVE-2026-22754, a high-severity authorization bypass vulnerability in Spring Security. This flaw impacts Spring Security versions 7.0.0 through 7.0.4. The issue arises when an application utilizes <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher. In such configurations, the servlet path is not correctly included, leading to authorization rules being bypassed.

This oversight means that security controls intended to protect specific endpoints are effectively nullified. An attacker could potentially access restricted resources or functionalities without proper authentication or authorization, depending on the application’s specific configuration. The National Vulnerability Database rates this with a CVSS score of 7.5 (HIGH), underscoring the critical need for immediate attention.

Defenders must audit their Spring Security configurations, particularly those employing servlet path definitions for URL interception. The attacker’s calculus here is straightforward: exploit misconfigurations to bypass security. CISOs should ensure development and security teams prioritize patching and configuration reviews to prevent unauthorized access.