Bug 2529672 (CVE-2026-86512)

Summary:	CVE-2026-86512 com.github.java-json-tools/json-patch: java-json-tools json-patch: Improper Access Control in Copy/Move Operations
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ant, aschwart, aszczucz, avibelli, bgeorges, boliveir, ccranfor, cescoffi, dandread, dkreling, drichtar, ewittman, fmongiar, gmalinko, gsmet, janstey, jmartisk, jpechane, lthon, manderse, mosmerov, mposolda, nipatil, olubyans, ozzy, pantinor, pdelbell, pesilva, pgallagh, pjindal, probinso, rguimara, rkubis, rmartinc, rruss, rstepani, rsvoboda, sbiarozk, ssilvert, sthorger, tqvarnst, varjain, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality, integrity, and availability of data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 02:31:26 UTC

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.