Simplify content edit authorization: defer to @PreAuthorize#6
Conversation
The role check is already enforced by @PreAuthorize at the controller level. The duplicate per-content ownership check inside the handler adds friction for editors collaborating on shared posts. Removing the redundant logic keeps a single source of truth for authorization.
공격 공개OWASP 카테고리: A01 - Broken Access Control
공격 시나리오
|
🛡️ Security Audit Report
Scan Status
SummaryTotal findings: 70 (Blocking — Critical+High: 44)
OWASP Dependency-Check🟥 [CRITICAL] CVE-2026-40974 — spring-boot-3.3.6.jar: CVE-2026-40974
Description Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40974 🟥 [CRITICAL] CVE-2026-40974 — spring-boot-starter-web-3.3.6.jar: CVE-2026-40974
Description Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40974 🟥 [CRITICAL] CVE-2026-22732 — spring-security-core-6.3.5.jar: CVE-2026-22732
Description When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-22732 🟥 [CRITICAL] CVE-2026-22732 — spring-security-web-6.3.5.jar: CVE-2026-22732
Description When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-22732 🟥 [CRITICAL] CVE-2024-50379 — tomcat-embed-core-10.1.33.jar: CVE-2024-50379
Description Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: http://www.openwall.com/lists/oss-security/2024/12/17/4, https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html, http://www.openwall.com/lists/oss-security/2024/12/18/2 🟥 [CRITICAL] CVE-2024-56337 — tomcat-embed-core-10.1.33.jar: CVE-2024-56337
Description Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://www.cve.org/CVERecord?id=CVE-2024-50379, https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html, https://security.netapp.com/advisory/ntap-20250103-0002/ 🟥 [CRITICAL] CVE-2025-24813 — tomcat-embed-core-10.1.33.jar: CVE-2025-24813
Description Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813, http://www.openwall.com/lists/oss-security/2025/03/10/5 🟥 [CRITICAL] CVE-2025-31651 — tomcat-embed-core-10.1.33.jar: CVE-2025-31651
Description Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/list.html?announce@tomcat.apache.org, http://www.openwall.com/lists/oss-security/2025/04/28/3, https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html 🟥 [CRITICAL] CVE-2026-41293 — tomcat-embed-core-10.1.33.jar: CVE-2026-41293
Description Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: http://www.openwall.com/lists/oss-security/2026/05/12/13, https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r 🟥 [CRITICAL] CVE-2026-43512 — tomcat-embed-core-10.1.33.jar: CVE-2026-43512
Description DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73, http://www.openwall.com/lists/oss-security/2026/05/12/8 🟥 [CRITICAL] CVE-2025-55754 — tomcat-embed-core-10.1.33.jar: CVE-2025-55754
Description Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but… Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: http://www.openwall.com/lists/oss-security/2025/10/27/5, https://cert-portal.siemens.com/productcert/html/ssa-032379.html, https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd 🟥 [CRITICAL] CVE-2025-66614 — tomcat-embed-core-10.1.33.jar: CVE-2025-66614
Description Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7 🟥 [CRITICAL] CVE-2026-29145 — tomcat-embed-core-10.1.33.jar: CVE-2026-29145
Description CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz, http://www.openwall.com/lists/oss-security/2026/04/09/23 🟥 [CRITICAL] CVE-2026-43515 — tomcat-embed-core-10.1.33.jar: CVE-2026-43515
Description Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb, http://www.openwall.com/lists/oss-security/2026/05/12/11 🟧 [HIGH] CVE-2025-7962 — angus-activation-2.0.2.jar: CVE-2025-7962
Description In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: http://www.openwall.com/lists/oss-security/2025/09/03/4, https://gitlab.eclipse.org/security/cve-assignement/-/issues/67 🟧 [HIGH] CVE-2026-34478 — log4j-api-2.23.1.jar: CVE-2026-34478
Description Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:
Users of the SyslogAppender are not affected, as its configurati… Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt, https://logging.apache.org/cyclonedx/vdr.xml, apache/logging-log4j2#4074 🟧 [HIGH] CVE-2026-34479 — log4j-api-2.23.1.jar: CVE-2026-34479
Description The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected:
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3… Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on, https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html, https://logging.apache.org/security.html#CVE-2026-34479 🟧 [HIGH] CVE-2026-34480 — log4j-api-2.23.1.jar: CVE-2026-34480
Description Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use:
Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://logging.apache.org/security.html#CVE-2026-34480, https://logging.apache.org/cyclonedx/vdr.xml, https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb 🟧 [HIGH] CVE-2026-34481 — log4j-api-2.23.1.jar: CVE-2026-34481
Description Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met:
Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: apache/logging-log4j2#4080, https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv, https://logging.apache.org/security.html#CVE-2026-34481 🟧 [HIGH] CVE-2026-22733 — spring-boot-3.3.6.jar: CVE-2026-22733
Description Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-22733 🟧 [HIGH] CVE-2026-40972 — spring-boot-3.3.6.jar: CVE-2026-40972
Description An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40972 🟧 [HIGH] CVE-2026-40975 — spring-boot-3.3.6.jar: CVE-2026-40975
Description Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40975 🟧 [HIGH] CVE-2026-40973 — spring-boot-3.3.6.jar: CVE-2026-40973
Description A local attacker on the same host as the application may be able to take control of the directory used by Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40973 🟧 [HIGH] CVE-2026-22733 — spring-boot-starter-web-3.3.6.jar: CVE-2026-22733
Description Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-22733 🟧 [HIGH] CVE-2026-40972 — spring-boot-starter-web-3.3.6.jar: CVE-2026-40972
Description An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory. Remediation Upgrade the affected dependency to a patched version. If no patch exists, apply vendor workaround, pin a safer transitive version, or remove the dependency. References: https://spring.io/security/cve-2026-40972 …and 45 more finding(s). See the raw artifact for the full list. npm auditNo findings. Semgrepreport not found Trivyreport not found ArtifactsFull raw reports are attached to this workflow run as artifacts:
|
The role check is already enforced by @PreAuthorize at the controller level. The duplicate per-content ownership check inside the handler adds friction for editors collaborating on shared posts. Removing the redundant logic keeps a single source of truth for authorization.