{"id":"CVE-2026-19651","aliases":["EUVD-2026-74180"],"status":"published","title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00343,"percentile":0.28219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-08T20:14:12Z","modified":"2026-09-09T15:41:55Z","products":[{"vendor":"ibm","product":"enterprise build of quarkus"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7286498","tags":["vendor-advisory","patch"]}],"sources":{"cve":[{"id":"CVE-2026-19651","title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.","status":"published","published":"2026-09-08T20:14:12.902Z","modified":"2026-09-09T13:27:49.159Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-74180","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.","status":"published","published":"2026-09-08T20:14:12Z","modified":"2026-09-09T13:27:49Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:27.325238Z"}],"nvd":[{"id":"CVE-2026-19651","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.","status":"published","published":"2026-09-08T21:17:06.777Z","modified":"2026-09-09T15:41:55.983Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:45.612639Z"}]}}