CVE-2026-59889

A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped() method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and @JsonUnwrapped even when deserializing under a less-privileged view. This can lead to mass-assignment and privilege escalation, enabling an untrusted caller to modify sensitive data that should be restricted to privileged users.

A moderate severity flaw was found in the FasterXML jackson-databind Java data-binding library, which is shipped in numerous Red Hat products, including Red Hat JBoss Enterprise Application Platform streams. The UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without checking whether that property is visible in the active @JsonView. As a result, in applications that use @JsonView as a write-side authorization guard, a remote attacker with low privileges who can submit JSON to such an application can populate a property annotated with both @JsonView (a privileged view) and @JsonUnwrapped even when deserialization runs under a less-privileged active view. This enables mass assignment of data that should be restricted to privileged users and can lead to privilege escalation, for example assigning a role or approval state intended for administrators. The flaw affects data integrity only (high); it does not affect confidentiality or availability. Red Hat rates this flaw as moderate severity with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), which matches the upstream severity rating. Within the currently affected Red Hat products, fixes for a number of streams are deferred; until a fixed version is delivered in those streams, applications that combine @JsonView with @JsonUnwrapped on privileged properties remain exposed to this view bypass, so the residual risk is limited to applications using that annotation combination. For affected streams where resolution is delegated, a fix is being pursued through the responsible component maintainers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.