A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.

Specifically, an application is vulnerable when the following condition is met:

• The application accepts and evaluates untrusted or user-controlled SpEL expressions.