Log in Start free

Vulnerability · Published Oct 12, 2026 · Assigned by redhat

CVE-2026-87744Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

Critical 9.1

In plain English

A critical-severity security flaw in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Quarkus 3.27.6.redhat see references
Red Hat Red Hat build of Quarkus 3.33.4.redhat see references
Red Hat Exploit Intelligence see references

Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References