How to fix CWE 566 Authorization Bypass Through User-Controlled SQL Primary Key

I have a JEE application that uses hibernate, and Veracode complains about some lines of code that I do not know how to fix. Basically, we have a generic class to perform basic operations on entities

    public void delete(T entity, final boolean cachable) {
        getHibernateTemplate().setCacheQueries(cachable);
        getHibernateTemplate().delete(entity);
    }

Then this code is called like this

...
            connectionDAO.delete(user, nbMaxConnections);
...

with the entity User for example which looks like this (I don't put the complete class definition)

@Entity
@Auditable
public class User extends Profile implements Cloneable,UserDetails,Principal
{   
    
    /** The enabled. */
    private Boolean enabled = true;
    
    /** The reason for disabled. */
    private String reasonForDisabled = null;
    
    /** The disabled date. */
    @Temporal(TemporalType.TIMESTAMP)
    private Date disabledDate = null;
    
    /** The parent. */
    @ManyToOne(fetch=FetchType.LAZY)
    @JoinColumn
    private Group parent = null;
    
    /** The information. */
    @Embedded
    private UserInformation information = null;
    
    /** The released date. */
    @Temporal(TemporalType.TIMESTAMP)
    private Date releasedDate = null;
    
    /** The nb wrong attempts. */
    private Integer nbWrongAttempts = null;
    
    private String salt;

and Veracode complains about the delete() call of hibernate template with the following description :

In this call to org.springframework.orm.hibernate5.HibernateOperations.delete, a data access statement could be executed with a primary key that can be controlled by externally provided values. If the provided primary key is not properly validated and the underlying storage does not restrict access to only entities that the user should be granted access to, it may be possible for an attacker to reference unauthorized records.

I don't know what to check (should I first check that the entity is present in the database before deleting it ?)

Regards