CVE-2025-41248
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/09/2025
Última modificación:
16/09/2025
Descripción
*** Pendiente de traducción *** The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.<br />
<br />
Your application may be affected by this if you are using Spring Security&#39;s @EnableMethodSecurity feature.<br />
<br />
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.<br />
<br />
This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA