CVE-2025-41232
Severity CVSS v4.0:
Pending analysis
Type:
CWE-693
Protection Mechanism Failure
Publication date:
21/05/2025
Last modified:
21/05/2025
Description
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.<br />
<br />
Your application may be affected by this if the following are true:<br />
<br />
* You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and<br />
* You have Spring Security method annotations on a private method<br />
In that case, the target method may be able to be invoked without proper authorization.<br />
<br />
You are not affected if:<br />
<br />
* You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or<br />
* You have no Spring Security-annotated private methods
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL