What Spring Data can teach us about API misconfiguration

A researcher disclosed a critical misconfiguration in Spring Data REST's ALPS that lets unauthenticated clients fetch profile schemas (Accept: application/schema+json), enumerate user resources under /alps/users (with pageable size abuse to dump many records), and perform create/modify/delete operations without authorization; mitigations include implementing Spring Security pre-/post-authorization, using SpEL expressions, and disabling unsafe HTTP methods server-side.