---
id: CVE-2024-22257
title: |-
  In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
  5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
  versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
  broken access control whe…
summary: |-
  In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
  5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
  versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
  broken access control whe…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-862
published: '2024-03-18'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22257'
references:
  - url: 'https://security.netapp.com/advisory/ntap-20240419-0005/'
    label: security@vmware.com
  - url: 'https://spring.io/security/cve-2024-22257'
    label: security@vmware.com
  - url: 'https://github.com/dependency-check/DependencyCheck/issues/8642'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240419-0005/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://spring.io/security/cve-2024-22257'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00956
epssPercentile: 0.59789
ingestedAt: '2026-06-30T13:26:50.066Z'
---

## Overview

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.