{"schema":"threatline.record/2","record":{"id":"CVE-2026-59889","aliases":["GHSA-5gvw-p9qm-jgwh"],"summary":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization","details":"## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` → `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact — write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false → the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) — recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) — `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.","categories":["Libraries & packages"],"product":"tools.jackson.core:jackson-databind","vendor":"FasterXML","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.0.0, <= 3.1.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.22.0, < 2.22.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.2.0, < 3.2.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.19.0, < 2.21.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.0.0-RC1, < 2.18.9"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59889","source_modified_at":"2026-10-19T19:32:26.642Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"jackson-databind","vendor":"FasterXML","versions":[{"version":">= 2.0.0-RC1, < 2.18.9","status":"affected"},{"version":">= 2.19.0, < 2.21.5","status":"affected"},{"version":">= 2.22.0, < 2.22.1","status":"affected"},{"version":">= 3.0.0, < 3.1.5","status":"affected"},{"version":">= 3.2.0, < 3.2.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.19.0"},{"fixed":"2.21.5"}],"type":"ECOSYSTEM"}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.5"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.0.0-RC1"},{"fixed":"2.18.9"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.22.0"},{"fixed":"2.22.1"}],"type":"ECOSYSTEM"}],"versions":["2.22.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"3.2.0"},{"fixed":"3.2.1"}],"type":"ECOSYSTEM"}],"versions":["3.2.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.1.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.22.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.2.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.21.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:31:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.18.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.21.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.1.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.18.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.22.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","source_modified_at":"2026-10-19T19:45:04.650428177Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.2.1"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00346,"percentile":0.26954,"score_date":"2026-10-23"},"published_at":"2026-07-14T19:57:48.473Z","modified_at":"2026-10-19T19:45:04.650428177Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T19:31:36Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59889","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T19:32:26.642Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-5gvw-p9qm-jgwh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T19:45:04.650428177Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59889","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/issues/6060","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/pull/6056","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-07-16T14:50:03.943048Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T19:45:04.650428177Z","content_hash":"b15d8f8baa951b096c5ad1aaeb059f841bfdb70747f9952f5b015a403bbc4bac"}}