CVE-2026-59889: 
Java vulnerability analysis and mitigation

CVE-2026-59889 is an incorrect authorization vulnerability in FasterXML's jackson-databind library, classified as a @JsonView bypass for @JsonUnwrapped container properties during deserialization. The flaw allows an authenticated low-privilege user to mass-assign properties restricted to higher-privilege views, enabling privilege escalation. Affected versions include com.fasterxml.jackson.core:jackson-databind 2.18.0–2.18.8, 2.21.0–2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0–3.1.4, 3.2.0. The issue was reported on June 26, 2026, patched on June 27, 2026, and published to the GitHub Advisory Database on July 21, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause (CWE-863: Incorrect Authorization) lies in UnwrappedPropertyHandler.processUnwrapped(), which replays buffered JSON for @JsonUnwrapped properties by iterating and calling prop.deserializeAndSet() without first checking prop.visibleInView(ctxt.getActiveView()). This guard was correctly applied to the creator path (processUnwrappedCreatorProperties()) in a prior fix (GHSA-rcqc-6cw3-h962 / #5971), but was never added to the regular Field/Setter property path. An attacker with low-privilege network access can craft a JSON request body containing fields belonging to a higher-privilege @JsonView group; because the view check is skipped, those fields are deserialized and written to the object. The fix adds a single prop.visibleInView(activeView) guard to the processUnwrapped() loop in both BeanDeserializer and BuilderBasedDeserializer, mirroring the existing creator-path fix (Github Advisory, Fix PR, Fix Commit).

Successful exploitation allows an authenticated attacker with low privileges to perform write-side mass-assignment of properties that should be restricted to higher-privilege views, resulting in a high integrity impact (C:N/I:H/A:N). A concrete example from the advisory demonstrates that an attacker submitting {"role":"ADMIN","approved":true,"creditBalance":1000000} to a public registration endpoint can elevate their account to admin status with an arbitrary credit balance. The vulnerability does not expose confidential data (no confidentiality impact) and does not affect availability, but the integrity compromise can have severe downstream consequences including unauthorized privilege escalation and financial data manipulation (Github Advisory).

1. Reconnaissance: Identify applications using jackson-databind versions 2.18.0–2.18.8, 2.21.0–2.21.4, 2.22.0, 3.0.0–3.1.4, or 3.2.0 that expose JSON deserialization endpoints (e.g., REST APIs for user registration or profile updates) and use both @JsonView and @JsonUnwrapped annotations together on privileged properties.
2. Obtain low-privilege access: Register or authenticate as a regular (non-admin) user on the target application to obtain a valid session or token.
3. Identify target endpoint: Locate an API endpoint that deserializes user-supplied JSON under a restricted view (e.g., readerWithView(PublicView.class)) where a privileged property block (e.g., AccountFlags) is annotated with both @JsonView(AdminView.class) and @JsonUnwrapped.
4. Craft malicious payload: Construct a JSON body that includes the flattened (unwrapped) privileged fields alongside legitimate public fields, e.g., {"email":"attacker@evil.test","password":"pw","role":"ADMIN","approved":true,"creditBalance":1000000}.
5. Submit request: Send the crafted JSON to the target endpoint using the low-privilege session. Because processUnwrapped() lacks the view guard, the privileged fields are deserialized and written to the object despite the active PublicView restriction.
6. Verify privilege escalation: Confirm that the account now has elevated privileges (e.g., admin role, approved status, or modified financial fields) by querying the application's profile or admin endpoints (Github Advisory, Fix Commit).

• Network: Unexpected JSON request bodies to registration or profile-update endpoints containing fields that belong to privileged data structures (e.g., role, approved, creditBalance) submitted by low-privilege users.
• Logs: Application logs showing low-privilege users successfully updating fields that should only be writable by administrators; audit logs reflecting unexpected role or permission changes for user accounts.
• Application Behavior: Sudden appearance of non-admin accounts with admin roles, approved status set without administrator action, or anomalous financial/credit balance values in user records.
• Dependency Scanning: Detection of vulnerable jackson-databind versions (2.18.0–2.18.8, 2.21.0–2.21.4, 2.22.0, 3.0.0–3.1.4, 3.2.0) via Nessus plugins 327170 or 328924, or container security plugin 445034.

Upgrade jackson-databind to one of the patched versions: 2.18.9, 2.21.5, 2.22.1 (for the 2.x com.fasterxml.jackson.core artifact), or 3.1.5, 3.2.1 (for the 3.x tools.jackson.core artifact). No configuration-based workaround is available; the only remediation is upgrading to a fixed version. As an interim measure, developers should audit their codebase for any properties annotated with both @JsonView and @JsonUnwrapped and consider temporarily removing @JsonUnwrapped from privileged properties until the upgrade is applied (Github Advisory, Fix PR).

The vulnerability was credited to researcher CyberKareem and published by FasterXML maintainer cowtowncoder on July 10, 2026. The fix was contributed by pjfanning and merged within days of the issue being filed, reflecting a rapid response from the jackson-databind maintainers. The advisory notes this is an incomplete fix of a prior related issue (GHSA-rcqc-6cw3-h962), highlighting the challenge of consistently applying security guards across all code paths. A Bluesky post from suriq.io and coverage on HeroDevs' blog discussing Spring Boot managed dependency CVEs in July 2026 indicate moderate community awareness (Github Advisory).