Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Quarkus REST Data Panache may allow unauthenticated access

CVE-2026-87744 · published today
Summary

The Quarkus REST Data Panache component in Red Hat's Build of Quarkus can unintentionally open generated API endpoints to anyone if a developer adds custom methods without re‑applying security settings. This can let an outside person view or change data without a login. Review custom endpoint code and be sure to re‑apply the required security roles, or update to a version where the issue is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
red hat exploit intelligence All versions
red hat red hat build of quarkus All versions
Original advisory text
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-425Direct Request ('Forced Browsing')
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-87744 · NVD
CVE-2026-87744 · MITRE
Track software like this
Free during beta