{"id":"CVE-2026-87744","published":"2026-10-12T19:16:40.277","lastModified":"2026-10-16T00:17:06.277","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-425"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83082","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:83520","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87744","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530524","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints when developers use @MethodProperties without re-declaring security roles, causing class-level security requirements to be silently dropped and endpoints to default to unauthenticated access.","exploitability":"Very easy to exploit with no preconditions; attackers can simply call the affected endpoints without authentication to gain unauthorized access.","blast_radius":"High impact across all applications using Quarkus REST Data Panache with customized operations that don't explicitly redeclare security roles, potentially exposing sensitive data or allowing unauthorized modifications.","remediation":"Upgrade to Quarkus 3.15.0 or later, which contains the fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rest-api","quarkus","data-access"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:02.154Z"}}