---
id: "CVE-2026-59889"
kind: "vulnerability"
aliases: ["CVE-2026-59889", "GHSA-5gvw-p9qm-jgwh"]
title: "jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"
severity: "medium"
cvss: 6.5
epss: 0.0034600000362843275
exploited: false
status: "open"
category: "package"
products: [{"name": "tools.jackson.core:jackson-databind", "fixed": ["3.1.5"], "affected": ">= 3.0.0, <= 3.1.4", "ecosystem": "maven"}, {"name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["2.22.1"], "affected": ">= 2.22.0, < 2.22.1", "ecosystem": "maven"}, {"name": "tools.jackson.core:jackson-databind", "fixed": ["3.2.1"], "affected": ">= 3.2.0, < 3.2.1", "ecosystem": "maven"}, {"name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["2.21.5"], "affected": ">= 2.19.0, < 2.21.5", "ecosystem": "maven"}, {"name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["2.18.9"], "affected": ">= 2.0.0-RC1, < 2.18.9", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-863", "jackson-databind", "java", "maven", "package", "rest-api"]
not_affected_if: ["fixed-version", "no-jsonview-on-unwrapped", "no-readerwithview-binding", "read-only-api"]
published_at: "2026-07-14T21:17:06+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5gvw-p9qm-jgwh", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

jackson-databind does not apply @JsonView checks when it replays @JsonUnwrapped container properties during deserialization, so a property hidden from the active view is still written from the request body. An attacker can set privileged fields such as role, approved status or balance on a public endpoint that relies on the view for write protection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:tools.jackson.core:jackson-databind affected >= 3.0.0, <= 3.1.4 fixed 3.1.5
- maven:com.fasterxml.jackson.core:jackson-databind affected >= 2.22.0, < 2.22.1 fixed 2.22.1
- maven:tools.jackson.core:jackson-databind affected >= 3.2.0, < 3.2.1 fixed 3.2.1
- maven:com.fasterxml.jackson.core:jackson-databind affected >= 2.19.0, < 2.21.5 fixed 2.21.5
- maven:com.fasterxml.jackson.core:jackson-databind affected >= 2.0.0-RC1, < 2.18.9 fixed 2.18.9

## How to check

Run mvn dependency:tree (or the Gradle equivalent) and check whether jackson-databind resolves to a version in an affected range. Then search the code for @JsonUnwrapped on properties that also carry @JsonView and for readerWithView usage.

## Fix

Upgrade jackson-databind to 3.1.5 (3.1.x line), 3.2.1 (3.2.x), 2.22.1 (2.22.x), 2.21.5 (2.21.x) or 2.18.9 (2.18.x). Until then, stop combining @JsonUnwrapped with @JsonView on writable properties.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-5gvw-p9qm-jgwh
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59889

## From the sources

## Summary
`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.

**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.

## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)
An `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` → `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.

## Impact — write-side mass-assignment / privilege escalation
`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.

## Affected
- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.
- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false → the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)

## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)
- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) — recursive bypass.
- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.
- builder-based deserializer (`@JsonDeserialize(builder=...)`) — `BuilderBasedDeserializer` routes through the same `processUnwrapped`.
- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.

## Fix
Add `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_