Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected applications are those that have enabled the COLLECTION_JSON or UBER hypermedia type (via @EnableHypermediaSupport or auto-configuration), expose a controller accepting a RepresentationModel subclass or EntityModel as @RequestBody, and whose bound model type exposes a setter for a security-sensitive property protected only through Jackson annotations rather than by the absence of a setter.