Authorization Bypass in Spring Security Aspects for Private Methods by Spring

CVE-2025-41232

What is CVE-2025-41232?

A vulnerability in Spring Security Aspects allows unauthorized access to private methods that have security annotations. When using @EnableMethodSecurity(mode=ASPECTJ) with spring-security-aspects, if a private method annotated with Spring Security method annotations is invoked, it may bypass intended authorization checks. Applications are at risk only if both conditions are met: the use of @EnableMethodSecurity(mode=ASPECTJ) and annotated private methods. To mitigate this risk, ensure that either the @EnableMethodSecurity is not utilized in the specified mode, or no security annotations are present on private methods.

References