diff --git a/modules/global/src/com/haulmont/addon/restapi/bom.properties b/modules/global/src/com/haulmont/addon/restapi/bom.properties
index 0eb08e8..92f10a3 100644
--- a/modules/global/src/com/haulmont/addon/restapi/bom.properties
+++ b/modules/global/src/com/haulmont/addon/restapi/bom.properties
@@ -14,4 +14,18 @@
 # limitations under the License.
 #
 org.springframework.security.oauth/spring-security-oauth2=2.5.1.RELEASE
-io.swagger/swagger-models=1.5.21
\ No newline at end of file
+io.swagger/swagger-models=1.5.21
+
+# We explicitly duplicate spring security dependencies versions defined in the CUBA bom.properties, because these versions
+# may be changed in CUBA bugfix releases, but REST API add-on releases depend on CUBA 7.2.0 and don't receive these versions
+# updates. That's why we need to store explicit version numbers right in the REST API add-on sources in order to control
+# dependencies.
+org.springframework.security=5.5.8
+org.springframework.security/spring-security-core=${org.springframework.security}
+org.springframework.security/spring-security-web=${org.springframework.security}
+org.springframework.security/spring-security-config=${org.springframework.security}
+org.springframework.security/spring-security-taglibs=${org.springframework.security}
+org.springframework=5.3.23
+org.springframework/spring-webmvc=${org.springframework}
+org.springframework/spring-context-support=${org.springframework}
+org.springframework.ldap/spring-ldap-core=2.3.8.RELEASE
\ No newline at end of file