{"id":"CVE-2026-87744","aliases":["EUVD-2026-97766","GHSA-jh67-c59w-8h9x"],"status":"published","title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00387,"percentile":0.33037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-425"],"published":"2026-10-12T18:41:46Z","modified":"2026-10-16T00:31:51Z","products":[{"vendor":"red hat","product":"exploit intelligence"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.6.redhat"},{"vendor":"red hat","product":"red hat build of quarkus 3.33.4.redhat"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83082","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87744","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530524","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87744"},{"url":"https://github.com/advisories/GHSA-jh67-c59w-8h9x"}],"sources":{"cve":[{"id":"CVE-2026-87744","title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","status":"published","published":"2026-10-12T18:41:46.751Z","modified":"2026-10-15T23:11:43.65Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T13:37:36.275898Z"}],"euvd":[{"id":"EUVD-2026-97766","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","status":"published","published":"2026-10-12T18:41:46Z","modified":"2026-10-15T23:11:43Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:00:06.711534Z"}],"ghsa":[{"id":"GHSA-jh67-c59w-8h9x","title":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated...","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","status":"published","published":"2026-10-12T21:31:55Z","modified":"2026-10-16T00:31:51Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T15:13:49.895192Z"}],"nvd":[{"id":"CVE-2026-87744","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","status":"published","published":"2026-10-12T19:16:40.277Z","modified":"2026-10-16T00:17:06.277Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:12:56.310333Z"}]}}