What’s Vulnerable › Vulnerabilities

CVE-2024-38810: Missing Authorization When Using @AuthorizeReturnObject

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-20 · updated 2026-06-17
• Weakness: CWE-287

Description

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

Affected products

• Spring Security: from 6.3.0 before 6.3.2 — fixed in 6.3.2
• Spring Security: from 6.3.x before 6.3.2 — fixed in 6.3.2

How to fix

Upgrade to a fixed version: Spring Security 6.3.2; Spring Security 6.3.2. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2024-38810

Get alerted when CVE-2024-38810 or the next vulnerability affects your stack