CVE-2026-47892

Affected versions of the `org.springframework:spring-webflux` package are vulnerable to Improper Authorization because a header predicate on a functional endpoint is not applied to a pre-flight request. A WebFlux application that uses functional endpoints and is deployed with `DispatcherServlet` evaluates route predicates for the pre-flight differently from the request that follows it, so a predicate written to require a header does not hold there. An attacker can use a crafted pre-flight request to reach a route the predicate exists to keep them out of.