CVE-2026-59889¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
In jackson-databind, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard. This allows a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker-supplied JSON under a less-privileged active view.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
jackson-databind is used across WSO2 Identity Server for JSON serialization and deserialization in REST, OAuth/OIDC and SCIM request handling. The distribution that reaches the runtime is within the affected range and is pre-fix: in the shipped class, UnwrappedPropertyHandler.processUnwrapped calls SettableBeanProperty.deserializeAndSet with no visibleInView or getActiveView call, while the sibling processUnwrappedCreatorProperties carries both, exactly the omission the advisory describes.
However, the trigger condition is not met. The defect requires a bean property annotated with both @JsonView and @JsonUnwrapped, deserialized from attacker-supplied JSON under a less-privileged active view. A review of every class in the shipped distribution found that the only artifacts naming both annotations are Jackson's own libraries, which declare them, and Swagger's schema introspection code, where they appear in reflective schema generation rather than on a bean. No bean shipped with the product combines the two annotations on a property, so the less-privileged-view write cannot occur.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. Since the exact vulnerable artifact is present and a clean drop-in minor fix exists, jackson-databind will be updated to a fixed version in a future release.