A critical authorization bypass vulnerability in Spring Security allows attackers to circumvent access controls on methods using @PreAuthorize or similar annotations.

The vulnerability stems from an incorrect resolution of security annotations on methods within type hierarchies that utilize parameterized super types with unbounded generics. This flaw primarily affects applications using the @EnableMethodSecurity feature, potentially allowing unauthenticated or unauthorized users to execute methods that should be protected.

The ability to bypass authorization checks poses a significant risk to data confidentiality and system integrity. Because this vulnerability allows unauthorized access to protected methods, it may lead to the exposure of sensitive data or the execution of privileged functions, justifying its CVSS score of 7.5.

Immediate Action: Upgrade to VMware Spring Security versions 6.4.11 or 6.5.5, or newer, as specified in the vendor advisory.

Proactive Monitoring: Review application access logs for unexpected successful invocations of sensitive methods that should typically be restricted by security annotations.

Compensating Controls: If patching is delayed, audit application code to identify if any critical methods are defined within generic superclasses or interfaces and implement manual access checks as a temporary safeguard.

Public Exploit Available: Unknown

Given the potential for unauthorized access to sensitive application logic, organizations should prioritize updating their Spring Security dependencies immediately. Failure to address this vulnerability could lead to significant security gaps in access control enforcement across the application stack.