Submit #892515: LogNet grpc-spring-boot-starter <=5.2.0 Improper Authorization

## 1. Summary

`grpc-spring-boot-starter` processes Spring Security `@Secured` annotations on gRPC services/methods (its
default authorization mechanism). When a method is covered by **both** a class-level `@Secured` and a
method-level `@Secured`, the starter **appends both into one attribute set** and evaluates it with
`AffirmativeBased` (grant if **any** attribute matches). Adding a broad class-level rule therefore **silently
weakens** a stricter method-level rule:
- method-level `@Secured("ROLE_ADMIN")` **alone** → a `ROLE_USER` caller is correctly **DENIED**;
- the **same** method rule **plus** class-level `@Secured("ROLE_USER")` → the same `ROLE_USER` caller is
**GRANTED** (`ADMIN` collapses to `USER OR ADMIN`).
This is a vertical privilege escalation. The merge is silent (no docs, no startup warning) and fails **open**.
Severity is conditional: exploitation requires a service that stacks a broad class-level `@Secured` with a
stricter method-level `@Secured` — a configuration reachable using only the library's documented annotations.
The report does not claim this is a common or recommended pattern; only that, when present, the library
resolves it insecurely. Concrete C/I impact depends on the bypassed method; the library-level defect is the
silent loss of the stricter guard.

• Source: ⚠️ https://github.com/LogNet/grpc-spring-boot-starter/issues/423
• User: Wayde.Shi24 (UID 98472)
• Submission: 07/16/2026 03:53 (2 months ago)
• Moderation: 08/30/2026 08:19 (2 months later)
• Status: Accepted
• VulDB entry: 397089 [LogNet grpc-spring-boot-starter up to 5.2.0 Annotation Processing improper authorization]
• Points: 20