A vulnerability in the Spring Framework annotation detection mechanism can lead to authorization bypasses when using security annotations within specific generic type hierarchies.

The vulnerability stems from an improper resolution of annotations on methods in type hierarchies involving parameterized super types with unbounded generics. This flaw is specifically triggered when applications utilize Spring Security's @EnableMethodSecurity feature.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive application functions, as security annotations intended to restrict access may be ignored by the framework. Given the CVSS score of 7.5, this is considered a High severity risk, as it directly undermines the integrity of the application's authorization logic and potentially exposes sensitive data or administrative functions to unauthenticated users.

Immediate Action: Upgrade to Spring Framework versions 6.2.11, 6.1.23, or 5.3.45 immediately to resolve the annotation detection flaw.

Proactive Monitoring: Review application access logs for unexpected access to protected endpoints and monitor for any anomalous behavior related to user authorization logic.

Compensating Controls: If patching is not immediately feasible, evaluate your codebase to determine if you are using @EnableMethodSecurity in conjunction with security annotations on methods within generic superclasses or interfaces, and consider restricting access to those specific paths at the network or WAF level.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to the authorization posture of Spring-based applications. Organizations should prioritize identifying whether their services utilize the vulnerable @EnableMethodSecurity configuration and proceed with the recommended version updates as a primary security control to ensure that all method-level security constraints are correctly enforced.