CVE-2026-19651
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
Risk Assessment
Risk of unauthorized access to resources or functions that should be protected by authorization, potentially leading to confidentiality or integrity breaches.
Recommendation
Update IBM Enterprise Build of Quarkus to a patched version or apply a workaround by validating query parameters server-side.
Other vulnerabilities in IBM Enterprise Build of Quarkus
See all- CVE-2026-77874High
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2026-16308High
IBM Enterprise Build of Quarkus REST has a vulnerability due to unbounded accumulation of multipart MIME part-header bytes, potentially leading to resource exhaustion.
Original NVD description (English source)
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.