CVE-2026-87744

CriticalCVSS 9.1

Published: 12/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Summary

A flaw was found in Quarkus REST Data Panache that allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. As a result, the affected endpoint defaults to permissive, unauthenticated access.

Risk Assessment

This may lead to unauthorized information disclosure or data modification by unauthenticated users, representing a serious breach of application security.

Recommendation

Update Quarkus REST Data Panache to a patched version and review existing endpoints to ensure security roles are explicitly declared when using @MethodProperties.

Other vulnerabilities in Quarkus REST Data Panache

CVE-2026-94451Medium
Quarkus REST Data Panache provides automatic REST endpoints for data entities. Certain endpoints do not validate the sort parameter supplied by users, allowing attackers to access unauthorized information or force the database into complex operations, potentially causing denial of service.

Original NVD description (English source)

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS