Spring Boot : Missing Authorization Vulnerability - CVE-2026-40976

In certain circumstances Spring Boots default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable it must: be a servlet-based web application have no Spring Security configuration of its own and rely on the default web security filter chain depend on spring-boot-actuator-autoconfigure not depend on spring-boot-health. If any of the above does not apply the application is not vulnerable. Affected: Spring Boot 4.0.04.0.5 upgrade