{"id":"CVE-2018-1258","aliases":["CLSA-2026-1785814744","EUVD-2018-0586","GHSA-cxrj-66c5-9fmh"],"status":"published","title":"Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02461,"percentile":0.84559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2018-05-11T20:00:00Z","modified":"2026-11-02T19:45:48Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-core","fixed_in":["5.0.6.RELEASE"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"last_affected":"5.0.5.RELEASE"},{"fixed":"5.0.6.RELEASE"}]}],"versions":["5.0.5.RELEASE"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.6.RELEASE"}]}],"versions":["5.0.5.RELEASE"]}],"products":[{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"storage_automation_store"},{"vendor":"oracle","product":"agile_product_lifecycle_management"},{"vendor":"oracle","product":"application_testing_suite"},{"vendor":"oracle","product":"big_data_discovery"},{"vendor":"oracle","product":"communications_converged_application_server"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_network_integrity"},{"vendor":"oracle","product":"communications_performance_intelligence_center"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"endeca_information_discovery_integrator"},{"vendor":"oracle","product":"enterprise_manager_for_mysql_database"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"goldengate_for_big_data"},{"vendor":"oracle","product":"health_sciences_information_manager"},{"vendor":"oracle","product":"healthcare_master_person_index"},{"vendor":"oracle","product":"hospitality_guest_access"},{"vendor":"oracle","product":"insurance_calculation_engine"},{"vendor":"oracle","product":"insurance_policy_administration"},{"vendor":"oracle","product":"insurance_rules_palette"},{"vendor":"oracle","product":"micros_lucas"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"peoplesoft_enterprise_fin_install"},{"vendor":"oracle","product":"retail_assortment_planning"},{"vendor":"oracle","product":"retail_back_office"},{"vendor":"oracle","product":"retail_central_office"},{"vendor":"oracle","product":"retail_customer_insights"},{"vendor":"oracle","product":"retail_financial_integration"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_point-of-service"},{"vendor":"oracle","product":"retail_returns_management"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"service_architecture_leveraging_tuxedo"},{"vendor":"oracle","product":"tape_library_acsls"},{"vendor":"oracle","product":"weblogic_server"},{"vendor":"pivotal","product":"spring framework"},{"vendor":"pivotal_software","product":"spring_security"},{"vendor":"redhat","product":"fuse"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"http://www.securityfocus.com/bid/104222","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1041888","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1041896","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2413","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://pivotal.io/security/cve-2018-1258","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1258","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cxrj-66c5-9fmh","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/commit/7b8fa90d96aaf751a3256fa755d5f17e081c20f1","tags":["web"]},{"url":"https://web.archive.org/web/20200807033751/http://www.securitytracker.com/id/1041896","tags":["web"]},{"url":"https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888","tags":["web"]},{"url":"https://web.archive.org/web/20200227032934/http://www.securityfocus.com/bid/104222","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-1258","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-05-11T20:00:00Z","modified":"2024-09-17T02:56:37.459Z","updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-0586","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-05-11T20:00:00Z","modified":"2024-09-17T02:56:37Z","updated_at":"2026-11-03T00:28:35.984836Z"}],"ghsa":[{"id":"GHSA-cxrj-66c5-9fmh","title":"Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-10-17T20:05:49Z","modified":"2024-03-14T21:08:22Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2018-1258","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-05-11T20:29:00.26Z","modified":"2026-08-25T16:28:27.31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-1258","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-05-11T20:29:00.26Z","modified":"2026-10-24T10:30:28.748465355Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-cxrj-66c5-9fmh","title":"Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","status":"published","published":"2018-10-17T20:05:49Z","modified":"2024-03-14T21:08:21Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"CLSA-2026-1785814744","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-11-02T19:45:48.950547253Z","updated_at":"2026-11-02T20:30:00.884471Z"}]}}