Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.

The PUT and merge-patch (application/merge-patch+json) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly.

Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silently overwrite a record belonging to a different principal (horizontal privilege escalation).

Affected applications are those that expose a Spring Data REST repository whose entity type declares an identifier or version property that is visible to Jackson's deserialization model (i.e. the property has a public setter and is not explicitly excluded via @JsonIgnore).