Authorization Bypass in Spring gRPC Affects Authenticated User Management
CVE-2026-40968

4.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Grpc
Vendor
CVE Published:
28 April 2026

What is CVE-2026-40968?

An authorization bypass vulnerability exists in Spring gRPC, where if an authenticated user is denied access to a gRPC method, their authenticated identity persists on the gRPC worker thread. This can be exploited by a subsequent unauthenticated request on the same thread, potentially allowing unauthorized access and escalated permissions for the second user. This flaw affects versions 1.0.0 to 1.0.2 of Spring gRPC and has been addressed in version 1.0.3.

Affected Version(s)

Spring gRPC 1.0.0 < 1.0.3

References

https://spring.io/security/cve-2026-40968

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.