CVE-2022-31692: Spring Security authorization rules bypass via forward or include dispatcher types
Summary
CVE-2022-31692: Spring Security authorization rules can be bypassed via forward or include dispatcher types. Affects org.springframework.security:spring-security-core across 2 version ranges.
>= 5.6.0, < 5.6.9
>= 5.7.0, < 5.7.5
Fixed in 5.6.9 or 5.7.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is org.springframework.security:spring-security-core, which is a part of the Spring Security framework. Spring Security provides authentication and authorization functionalities for Java applications. It allows developers to secure their applications by defining access rules and enforcing them during runtime. This vulnerability affects versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 of the package.
Vulnerability Detail
The vulnerability in Spring Security allows attackers to bypass authorization rules by exploiting the forward or include dispatcher types. This vulnerability can be exploited when an application meets the following conditions: 1) The application expects Spring Security to apply security to forward and include dispatcher types. 2) The application uses the AuthorizationFilter manually or via the authorizeHttpRequests() method. 3) The application configures the FilterChainProxy to apply to forward and/or include requests. 4) The application forwards or includes the request to a higher privilege-secured endpoint. By exploiting this vulnerability, an attacker can gain unauthorized access to higher privilege-secured endpoints, potentially leading to unauthorized actions and data breaches.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.6.0, < 5.6.95.6.9 -
>= 5.7.0, < 5.7.55.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the Spring Security package.
Conclusion
In conclusion, the Spring Security package versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 are vulnerable to authorization rules bypass via forward or include dispatcher types. This vulnerability can be exploited to gain unauthorized access to higher privilege-secured endpoints. It is recommended to upgrade to the fixed versions of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a framework that provides authentication and authorization functionalities for Java applications. It allows developers to secure their applications by defining access rules and enforcing them during runtime.
This vulnerability allows attackers to bypass authorization rules and gain unauthorized access to higher privilege-secured endpoints. This can lead to unauthorized actions and potential data breaches.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the Spring Security package. Upgrade to version 5.7.5 if you are using versions 5.7.0 to 5.7.4, or upgrade to version 5.6.9 if you are using versions 5.6.0 to 5.6.8.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the Spring Security package.
You can find more information about this vulnerability in the GitHub Advisory Database. Please refer to the provided source link for detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
