Read the docs
TI-2025-27479 Aliases CVE-2025-41232GHSA-9pp5-9c7g-4r83

CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

Priority MEDIUM 48CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00627 50th percentileScored 2026-11-07
Fix Fixed Spring Security (Spring): 6.4.6org.springframework.security:spring-security-aspects (Maven): 6.4.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Security6.4.x to before 6.4.66.4.6Patch availableCNA
—org.springframework.security:spring-security-aspects (Maven)6.4.0 to before 6.4.66.4.6Patch availableGHSA-9pp5-9c7g-4r83
—org.springframework.security:spring-security-core (Maven)6.4.0 to before 6.4.66.4.6Patch availableGHSA-9pp5-9c7g-4r83
  • Spring Security VendorVMware Affected 6.4.x to before 6.4.6 Fixed in 6.4.6 Patch available CNA
  • org.springframework.security:spring-security-aspects (Maven) Vendor— Affected 6.4.0 to before 6.4.6 Fixed in 6.4.6 Patch available GHSA-9pp5-9c7g-4r83
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.4.0 to before 6.4.6 Fixed in 6.4.6 Patch available GHSA-9pp5-9c7g-4r83

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*——VMware
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions — — ·VMware

Remediation

  • Fix · CNA Spring Security (Spring) Fixed in 6.4.6
  • Fix · GHSA-9pp5-9c7g-4r83 org.springframework.security:spring-security-aspects (Maven) Fixed in 6.4.6 Advisory →
  • Fix · GHSA-9pp5-9c7g-4r83 org.springframework.security:spring-security-core (Maven) Fixed in 6.4.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 13 products
  • A-MQ Clients 2
  • OpenShift Developer Tools and Services
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41232
  2. 2026-10-03 Alias added: GHSA-9pp5-9c7g-4r83
  3. 2026-11-04 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 5

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences