Security1 hOctober 30, 2026, 17:37

Apache Struts JVN#82782759: @JsonAnySetter authorization bypass

JVN disclosed a medium-severity flaw in the Apache Struts 7.2.1–7.3.0 REST plugin where @StrutsParameter checks are not applied to fields accepted via @JsonAnySetter, allowing data tampering. Mitigation requires upgrading to 7.4.0 and enabling struts.rest.anySetter.requireAnnotations=true.

DEV Community

Open source

Apache Struts JVN#82782759: @JsonAnySetter authorization bypass

Affected: Apache Struts 7.2.1–7.3.0 with the REST plugin and Jackson
@StrutsParameter checks do not cover @JsonAnySetter fields
Fix needs 7.4.0+ and struts.rest.anySetter.requireAnnotations=true
Dynamic keys require @StrutsParameter(allowDynamicKeys = true)

#Apache#Struts#Jackson

Apache ZooKeeper authorization bypass found in deleteContainer path

Security

CVE-2016-3081 in Apache Struts added to CISA's exploited vulnerabilities catalog

Security

Drupal Commerce Core authorization bypass flaw actively exploited

Security

Apache Struts JVN#82782759: @JsonAnySetter authorization bypass

Apache ZooKeeper authorization bypass found in deleteContainer path

CVE-2016-3081 in Apache Struts added to CISA's exploited vulnerabilities catalog

Drupal Commerce Core authorization bypass flaw actively exploited

IntentKit tool authorization bypass exposed in CVE-2026-76066