Changeflow GovPing Data Privacy & Cybersecurity Spring Multiple Vulnerabilities: Privilege Esca...
Priority review Notice Added Final

Spring Multiple Vulnerabilities: Privilege Escalation, SSRF, XSS

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published advisory CERTFR-2026-AVI-0477 on April 22, 2026, alerting to multiple vulnerabilities in Spring products including Authorization Server (versions 1.3.x before 1.3.11, 1.4.x before 1.4.10, 1.5.x before 1.5.7) and Security (versions 5.7.x through 7.0.x prior to stated patches). Seven CVEs are referenced: CVE-2026-22746, CVE-2026-22747, CVE-2026-22748, CVE-2026-22751, CVE-2026-22752, CVE-2026-22753, and CVE-2026-22754. The vulnerabilities enable security policy bypass, SSRF, remote indirect code injection (XSS), unspecified vendor issues, and privilege escalation. Affected organizations should consult Spring's security bulletins for available patches.

“De multiples vulnérabilités ont été découvertes dans les produits Spring.”

— CERT-FR , verbatim from source
Why this matters

Organizations running Spring Authorization Server or Spring Security should inventory all deployed instances and compare version numbers against the affected ranges (1.3.x < 1.3.11, 1.4.x < 1.4.10, 1.5.x < 1.5.7, 5.7.x < 5.7.23, 5.8.x < 5.8.25, 6.3.x < 6.3.16, 6.4.x < 6.4.16, 6.5.x < 6.5.10, 7.0.x < 7.0.5). Given the privilege escalation and XSS attack vectors, patch deployment should be treated as time-sensitive regardless of whether the affected component is internet-facing.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

GovPing monitors CERT-FR Security Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 183 changes logged to date.

View original document View source feed page

What changed

CERT-FR published an alert detailing seven security vulnerabilities affecting Spring Authorization Server and Spring Security across multiple version branches. The vulnerabilities enable an attacker to achieve security policy bypass, server-side request forgery (SSRF), remote indirect code injection (XSS), unspecified impacts, and privilege escalation. Organizations running affected Spring versions (Authorization Server 1.3.x–1.5.x and Security 5.7.x–7.0.x) should immediately consult Spring.io security bulletins and apply the available patches to mitigate the risk of exploitation.

Affected parties include any organization using Spring Authorization Server or Spring Security products in the versions specified. System administrators and security teams should prioritize inventorying deployed Spring installations, identifying affected versions, and applying vendor-issued patches without delay given the severity of privilege escalation and remote code injection risks.

What to do next

  1. Consult Spring security bulletins for patch information

Archived snapshot

Apr 22, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 22 avril 2026 N° CERTFR-2026-AVI-0477 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Spring

Gestion du document

| Référence | CERTFR-2026-AVI-0477 |
| Titre | Multiples vulnérabilités dans les produits Spring |
| Date de la première version | 22 avril 2026 |
| Date de la dernière version | 22 avril 2026 |
| Source(s) | Bulletin de sécurité Spring cve-2026-22746 du 20 avril 2026
Bulletin de sécurité Spring cve-2026-22747 du 20 avril 2026
Bulletin de sécurité Spring cve-2026-22748 du 20 avril 2026
Bulletin de sécurité Spring cve-2026-22753 du 20 avril 2026
Bulletin de sécurité Spring cve-2026-22754 du 20 avril 2026
Bulletin de sécurité Spring cve-2026-22751 du 21 avril 2026
Bulletin de sécurité Spring cve-2026-22752 du 21 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Contournement de la politique de sécurité
  • Falsification de requêtes côté serveur (SSRF)
  • Injection de code indirecte à distance (XSS)
  • Non spécifié par l'éditeur
  • Élévation de privilèges

Systèmes affectés

  • Authorization Server versions 1.3.x antérieures à 1.3.11
  • Authorization Server versions 1.4.x antérieures à 1.4.10
  • Authorization Server versions 1.5.x antérieures à 1.5.7
  • Security versions 5.7.x antérieures à 5.7.23
  • Security versions 5.8.x antérieures à 5.8.25
  • Security versions 6.3.x antérieures à 6.3.16
  • Security versions 6.4.x antérieures à 6.4.16
  • Security versions 6.5.x antérieures à 6.5.10
  • Security versions 7.0.x antérieures à 7.0.5

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 22 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Atlassian Products Allow Remote Code Execution
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr NetApp Multiple Vulnerabilities Allow Data Confidentiality Breach
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Microsoft .NET Vulnerability Enables Privilege Escalation (CVE-2026-40372)
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 22nd, 2026
Instrument
Notice
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Substantive

Who this affects

Applies to
Technology companies Manufacturers
Industry sector
5112 Software & Technology
Activity scope
Vulnerability disclosure Software patching Security advisory
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Consumer Protection

Browse Categories

Agriculture & Food Safety 74 AI Regulation 3 Banking & Finance 426 Consumer Protection 90 Courts & Legal 417 Data Privacy & Cybersecurity 90 Defense & National Security 53 Education 60 Energy 101 Environment 160 Gaming 2 Government & Legislation 439 Healthcare 15 Healthcare & Life Sciences 387 Immigration 10 Insurance 80 Labor & Employment 146 Pharma & Drug Safety 21 Professional Licensing 8 Real Estate & Housing 82 Securities & Markets 158 Tax 82 Telecom & Technology 48 Trade & Sanctions 141 Transportation 91

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!