{"id":"CVE-2026-39852","aliases":["EUVD-2026-27500","GHSA-rc95-pcm8-65v9"],"status":"published","title":"Quarkus authorization bypass via semicolon path normalization inconsistency","description":"Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00712,"percentile":0.53914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-551","CWE-863"],"published":"2026-05-04T17:20:20Z","modified":"2026-11-10T02:32:05Z","fixes":[{"ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","fixed_in":["3.20.6.1","3.27.3.1","3.33.1.1","3.35.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.6.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.27.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.30.0"},{"fixed":"3.33.1.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"3.35.1.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.6.1"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.28.0","0.28.1","1.0.0.CR1","1.0.0.CR2","1.0.0.Final","1.0.1.Final","1.1.0.CR1","1.1.0.Final","1.1.1.Final","1.10.0.CR1","1.10.0.Final","1.10.1.Final","1.10.2.Final","1.10.3.Final","1.10.4.Final","1.10.5.Final","1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.3.0.Alpha1","1.3.0.Alpha2","1.3.0.CR1","1.3.0.CR2","1.3.0.Final","1.3.1.Final","1.3.2.Final","1.3.3.Final","1.3.4.Final","1.4.0.CR1","1.4.0.Final","1.4.1.Final","1.4.2.Final","1.5.0.CR1","1.5.0.Final","1.5.1.Final","1.5.2.Final","1.6.0.CR1","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.CR2","1.7.0.Final","1.7.1.Final","1.7.2.Final","1.7.3.Final","1.7.4.Final","1.7.5.Final","1.7.6.Final","1.8.0.CR1","1.8.0.Final","1.8.1.Final","1.8.2.Final","1.8.3.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.11.Final","2.16.12.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final","3.0.0.Alpha1","3.0.0.Alpha2","3.0.0.Alpha3","3.0.0.Alpha4","3.0.0.Alpha5","3.0.0.Alpha6","3.0.0.Beta1","3.0.0.CR1","3.0.0.CR2","3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.15.3.1","3.15.4","3.15.5","3.15.6","3.15.6.1","3.15.6.2","3.15.7","3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.19.0.CR1","3.19.1","3.19.2","3.19.3","3.19.4","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.10.Final","3.2.11.Final","3.2.12.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final","3.2.6.Final","3.2.7.Final","3.2.8.Final","3.2.9.Final","3.20.0","3.20.0.CR1","3.20.1","3.20.2","3.20.2.1","3.20.2.2","3.20.3","3.20.4","3.20.5","3.20.6","3.3.0","3.3.0.CR1","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0.CR1","3.4.1","3.4.2","3.4.3","3.5.0","3.5.0.CR1","3.5.1","3.5.2","3.5.3","3.6.0","3.6.0.CR1","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","3.7.0","3.7.0.CR1","3.7.1","3.7.2","3.7.3","3.7.4","3.8.0","3.8.0.CR1","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.6.1","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0"},{"fixed":"3.27.3.1"}]}],"versions":["3.21.0","3.21.1","3.21.2","3.21.3","3.21.4","3.22.0","3.22.0.CR1","3.22.1","3.22.2","3.22.3","3.23.0","3.23.0.CR1","3.23.1","3.23.2","3.23.3","3.23.4","3.24.0","3.24.0.CR1","3.24.1","3.24.2","3.24.3","3.24.4","3.24.5","3.25.0","3.25.0.CR1","3.25.1","3.25.2","3.25.3","3.25.4","3.26.0","3.26.0.CR1","3.26.1","3.26.2","3.26.3","3.26.4","3.27.0","3.27.0.CR1","3.27.1","3.27.2","3.27.3"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.30.0"},{"fixed":"3.33.1.1"}]}],"versions":["3.30.0","3.30.1","3.30.2","3.30.3","3.30.4","3.30.5","3.30.6","3.30.7","3.30.8","3.31.0","3.31.0.CR1","3.31.1","3.31.2","3.31.3","3.31.4","3.32.0","3.32.0.CR1","3.32.1","3.32.2","3.32.3","3.32.4","3.33.0","3.33.0.CR1","3.33.1"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"3.35.1.1"}]}],"versions":["3.34.0","3.34.1","3.34.2","3.34.3","3.34.4","3.34.5","3.34.6","3.34.7","3.35.0","3.35.0.CR1","3.35.1"]}],"products":[{"vendor":"quarkus","product":"quarkus"},{"vendor":"quarkusio","product":"quarkus"},{"vendor":"red hat","product":"cryostat 4 on rhel 9"},{"vendor":"red hat","product":"hawtio hawtio 4.4.0"},{"vendor":"red hat","product":"openshift serverless"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apache camel 4.14 for quarkus 3.27"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat build of quarkus 3.20.6.sp1"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.3.sp1"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"streams for apache kafka 2.9.4"},{"vendor":"red hat","product":"streams for apache kafka 3.2.1"}],"references":[{"url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39852","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457819","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39852.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17789","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13631","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11720","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11721","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39852","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rc95-pcm8-65v9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39852.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39852","title":"Quarkus authorization bypass via semicolon path normalization inconsistency","description":"Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.","status":"published","published":"2026-05-05T20:58:29.575Z","modified":"2026-08-17T12:05:19.346Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-863","CWE-551"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-27500","description":"Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.","status":"published","published":"2026-05-05T20:58:29Z","modified":"2026-08-17T12:05:19Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:49.335011Z"}],"ghsa":[{"id":"GHSA-rc95-pcm8-65v9","title":"Quarkus has Authentication/Authorization bypasses","description":"Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources.\n\nUnauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (`;`) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's [security layer](https://quarkus.io/guides/security-authorize-web-endpoints-reference) performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like `/api/admin;anything` to bypass policies protecting `/api/admin` while still routing to the protected endpoint.\n\n\n### Impact\n\nThis issue may lead to Authentication/Authorization bypasses.\n\n### Credits\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).","status":"published","published":"2026-05-04T17:20:20Z","modified":"2026-08-13T15:33:52Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-287","CWE-551","CWE-863"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-39852","description":"Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.","status":"published","published":"2026-05-05T21:16:22.823Z","modified":"2026-08-17T12:18:23.367Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863","CWE-551"],"updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"CVE-2026-39852","title":"Quarkus authorization bypass via semicolon path normalization inconsistency","description":"Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.","status":"published","published":"2026-05-05T20:58:29.575Z","modified":"2026-11-10T02:32:05.22921675Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-10T02:45:42.584685Z"},{"id":"GHSA-rc95-pcm8-65v9","title":"Quarkus has Authentication/Authorization bypasses","description":"Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources.\n\nUnauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (`;`) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's [security layer](https://quarkus.io/guides/security-authorize-web-endpoints-reference) performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like `/api/admin;anything` to bypass policies protecting `/api/admin` while still routing to the protected endpoint.\n\n\n### Impact\n\nThis issue may lead to Authentication/Authorization bypasses.\n\n### Credits\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).","status":"published","published":"2026-05-04T17:20:20Z","modified":"2026-09-10T03:50:47.474405444Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287","CWE-551","CWE-863"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}