{"id":"CVE-2026-87744","revision":"60b20ebdec7f4459adf99d841f646ab1","records":[{"revision":"60b20ebdec7f4459adf99d841f646ab1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-87744","aliases":[],"title":"Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations","description":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","state":0,"publishedAt":"2026-10-12T18:41:46.751+00:00","modifiedAt":"2026-10-15T23:11:43.65+00:00","affected":[{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Quarkus 3.27.6.redhat\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"io.quarkus/quarkus-hibernate-orm-rest-data-panache\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.27.6.redhat-00004\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:quarkus:3.27::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"io.quarkus/quarkus-hibernate-orm-rest-data-panache","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Quarkus 3.33.4.redhat\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"io.quarkus/quarkus-hibernate-orm-rest-data-panache\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.33.4.redhat-00004\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:quarkus:3.33::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"exploit-intelligence/agent-client-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Exploit Intelligence\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"exploit-intelligence/agent-client-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:exploit_intelligence:0\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://access.redhat.com/errata/RHSA-2026:83082","https://access.redhat.com/errata/RHSA-2026:83520","https://access.redhat.com/security/cve/CVE-2026-87744","https://bugzilla.redhat.com/show_bug.cgi?id=2530524"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-87744","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-87744","identifiers":["CVE-2026-87744"]},"retained":false,"historicalAffected":[]}],"coverage":[]}