CVE-2026-86512
java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-284 CWE-266 |
| Vendor | java-json-tools |
| Product | json-patch |
| Published | Sep 8, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for java-json-tools json-patch
Be the first to know when new medium vulnerabilities affecting java-json-tools json-patch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
java-json-tools / json-patch
1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13
References
vuldb.com: https://vuldb.com/vuln/399666 vuldb.com: https://vuldb.com/vuln/399666/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86512 vuldb.com: https://vuldb.com/submit/908391 github.com: https://github.com/java-json-tools/json-patch/issues/170 github.com: https://github.com/java-json-tools/json-patch/
Credits
🔍 York Shen - Yong Shen - PayPal Cyber Security Team (VulDB User) VulDB CNA Team