CVE-2026-59889 Root-Cause Fix Review for jackson-databind @JsonUnwrapped @JsonView Deserialization Bypass

Vulnerability

CVE-2026-59889 describes a deserialization authorization bypass in jackson-databind where @JsonView restrictions were not enforced for @JsonUnwrapped field/setter properties. In the vulnerable flow, UnwrappedPropertyHandler replays buffered input into unwrapped properties, but the replay path did not validate whether each target property was visible in the currently active view. That breaks the expected write-side access-control semantics of readerWithView(...) and enables mass assignment of privileged fields from attacker-controlled JSON.

The supplied regression test demonstrates the issue concretely: a public registration DTO exposes email and password to PublicView, while an admin-only AccountFlags object is annotated with both @JsonView(AdminView.class) and @JsonUnwrapped. Under vulnerable behavior, flattened JSON members such as role, approved, and creditBalance can still populate the hidden admin-only object during a PublicView read, even though the non-unwrapped control case correctly leaves the property unset. This is source-grounded in the added test class and release note for issue #6060 in the fixing commit d627a8a and PR #6056.

// [databind#6060]: honor active @JsonView -- skip Field/Setter properties not
// visible in the active view rather than populating them from buffered input.
final Class<?> activeView = ctxt.getActiveView();
    if ((activeView != null) && !prop.visibleInView(activeView)) {
        continue;
    }

The broader source context also matters. Related fixes show the same class of mistake in nearby deserialization paths: unwrapped creator parameters were fixed separately in #5971 and backported via #5973, while setterless creator-property view bypasses were fixed in #5969. That history indicates a recurring pattern: buffered or alternate property application paths can drift from the main view-filtered path unless they explicitly consult ctxt.getActiveView().

Patch

The CVE patch modifies src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java to fetch the active view from the deserialization context and skip any unwrapped field/setter property that is not visible in that view. This is the correct enforcement point because the vulnerability occurs during replay of buffered unwrapped content, not during ordinary property discovery. The release notes explicitly record the fix as #6060: `@JsonView` by-passed for `@JsonUnwrapped` Field/Setter properties in commit d627a8a.

The test coverage added in UnwrappedViewBypass6060Test is well targeted. It includes: a control object where a non-unwrapped admin-only property remains null under PublicView; a vulnerable unwrapped-field case that must now remain null under PublicView; a setter-based unwrapped variant; and negative controls proving that the same unwrapped admin-only block is populated under AdminView. Those negative controls are important because they verify the patch preserves intended functionality rather than merely suppressing all unwrapped assignment.

Registration r = mapper.readerWithView(PublicView.class)
        .forType(Registration.class)
        .readValue(jsonR);
assertNull(r.flags, "expected registration flag to be null in PublicView read");

From the available snippets, the patch is narrow and behaviorally aligned with prior view-bypass fixes in the same codebase. The implementation mirrors the earlier #5971 fix for creator parameters in the same handler, suggesting a consistent remediation strategy across unwrapped replay paths. Relevant sources: PR #6056, commit d627a8a, and related prior fix PR #5971.

Review

Pros

• Fixes the actual missing authorization check at the point where unwrapped properties are materialized from buffered input, which is the root of the bypass for field/setter-backed @JsonUnwrapped properties.
• Uses existing framework semantics via ctxt.getActiveView() and prop.visibleInView(activeView), reducing the risk of inventing divergent access-control logic.
• Regression tests cover both field and setter variants, matching the release-note scope of Field/Setter properties.
• Negative controls validate that AdminView still deserializes the unwrapped object, so the patch does not overcorrect by disabling unwrapped assignment entirely.
• The remediation pattern is consistent with adjacent security fixes in the same subsystem, especially the unwrapped creator-parameter fix in #5971.

Cons

• The patch is scoped to field/setter-backed unwrapped properties for issue #6060; it is not, by itself, a complete audit of all @JsonView-sensitive deserialization paths.
• Source history shows multiple nearby view-bypass regressions (#5971, #5969), which suggests systemic fragility around alternate buffering/replay paths.
• No snippet here shows broader invariant tests asserting that every property-application path in deserialization uniformly enforces active views; coverage is good for the reported bug but localized.
• The test payload mixes nested and flattened forms across control and exploit cases, which is sufficient for the bug but does not exhaustively exercise polymorphism, aliases, or mixed creator/setter combinations.

Verdict

Root-cause.

For the vulnerability named in CVE-2026-59889, the patch fixes the root cause: UnwrappedPropertyHandler failed to honor the active @JsonView when replaying buffered data into unwrapped field/setter properties. The added visibleInView gate is the correct control, and the new tests demonstrate both exploit prevention under PublicView and expected behavior under AdminView. The only caveat is architectural rather than CVE-specific: jackson-databind has had several neighboring view-bypass bugs in alternate deserialization paths, so maintainers should treat this as one root-cause fix within a broader class of path-consistency issues, not as evidence that the entire @JsonView surface is now comprehensively hardened. Primary references: fix commit, patch PR, CVE record.