{"id":"CVE-2026-107912","published":"2026-11-05T14:16:59.697","lastModified":"2026-11-05T17:17:35.427","description":"A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-107912","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548364","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}