Skip to main content

Direct Request ('Forced Browsing') in org.springframework.security:spring-security-web

CVE-2026-22732

  • org.springframework.security:spring-security-web
High
9.1/10

Summary

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: through 6.5.8, and 7.x through 7.0.3.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-425 - Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References

Advisory Timeline

  • Published