CVE-2026-86512: java-json-tools json-patch Auth Bypass

CVE-2026-86512 Overview

CVE-2026-86512 affects the java-json-tools/json-patch library through version 1.13. The flaw resides in the CopyOperation.apply and MoveOperation.apply functions within src/main/java/com/github/fge/jsonpatch/CopyOperation.java. Manipulation of these copy and move operations leads to improper access controls [CWE-266]. A remote attacker with low privileges can exploit the weakness over the network, and a public exploit is available. The maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
Remote attackers can abuse the Copy and Move operations of the JSON Patch library to bypass intended access restrictions on JSON documents, with a public proof of concept increasing exploitation likelihood.

Affected Products

java-json-tools/json-patch versions up to and including 1.13
Java applications embedding the com.github.fge.jsonpatch package
Downstream services accepting user-supplied JSON Patch documents (RFC 6902)

Discovery Timeline

2026-09-08 - CVE-2026-86512 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86512

Vulnerability Analysis

The java-json-tools/json-patch library implements RFC 6902 JSON Patch, allowing clients to submit patch documents that modify JSON structures on the server. The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment, meaning the Copy and Move operations do not properly enforce access control on the source or target paths within a JSON document.

An attacker who is authorized to issue patch requests can craft copy or move operations that reference paths the application intended to keep read-only or hidden. Because the checks occur only on the direct target of a patch, indirect writes through copy/move bypass those controls. The public proof of concept referenced in the VulDB entry demonstrates remote exploitation over the network.

Root Cause

The root cause is missing authorization enforcement inside CopyOperation.apply and MoveOperation.apply in src/main/java/com/github/fge/jsonpatch/CopyOperation.java. Both methods traverse and mutate JSON nodes based solely on the paths supplied in the patch, without evaluating whether the calling context is permitted to read or write those paths.

Attack Vector

Exploitation requires network reachability to an application endpoint that accepts JSON Patch input and low-level authenticated access. The attacker submits a JSON Patch document containing copy or move operations whose from or path values reference restricted fields, tampering with data or exposing it through the operation's side effects. See the GitHub Issue #170 Discussion for the original report.

No verified exploit code is published in a sanitized form. Refer to the linked references for technical detail.

Detection Methods for CVE-2026-86512

Indicators of Compromise

Inbound HTTP requests containing JSON Patch bodies with "op":"copy" or "op":"move" targeting sensitive object paths such as /role, /permissions, or /isAdmin.
Unexpected mutations of protected fields in application audit logs shortly after PATCH requests.
Application error traces originating from com.github.fge.jsonpatch.CopyOperation or MoveOperation on unusual paths.

Detection Strategies

Instrument the application layer to log the full JSON Patch payload and the authenticated principal for every PATCH request.
Add server-side allow-lists that reject any patch operation whose path or from resolves outside a permitted subtree.
Deploy WAF rules that inspect JSON bodies and flag copy/move operations referencing administrative fields.

Monitoring Recommendations

Alert on anomalous rates of PATCH requests per user or per endpoint that accepts JSON Patch input.
Correlate privilege changes in identity or authorization stores with preceding PATCH traffic against services using json-patch.
Track dependency inventories for com.github.fge:json-patch at versions <= 1.13 and prioritize monitoring on those services.

How to Mitigate CVE-2026-86512

Immediate Actions Required

Inventory all Java services that include com.github.fge:json-patch version 1.13 or earlier via Maven or Gradle dependency graphs.
Restrict endpoints accepting JSON Patch input to authenticated, least-privilege principals and reject copy/move operations at the API gateway where possible.
Enforce field-level authorization inside the application after applying a patch, comparing the resulting document to a schema of write-allowed fields.

Patch Information

At the time of publication, no upstream fix has been released. The maintainers were notified via GitHub Issue #170 but have not responded. Track the java-json-tools/json-patch repository for a patched release, and consult the VulDB CVE-2026-86512 entry for updates.

Workarounds

Replace json-patch with an alternative library that enforces path-level authorization, or fork and add access checks inside CopyOperation.apply and MoveOperation.apply.
Pre-validate incoming JSON Patch documents and drop any operation whose op is copy or move when the target application does not require them.
Apply patches against a sandboxed copy of the document, then diff the result and reject changes that touch protected fields before persisting.

bash

# Configuration example: reject copy/move operations at an NGINX reverse proxy
location /api/ {
    if ($request_method = PATCH) {
        # Block JSON Patch bodies containing copy or move operations
        if ($request_body ~* "\"op\"\s*:\s*\"(copy|move)\"") {
            return 403;
        }
    }
    proxy_pass http://backend;
}