Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
io.quarkus:quarkus-hibernate-orm-rest-data-panache: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations URL: https://access.redhat.com/security/cve/cve-2026-87744 Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1
Quarkus REST Data Panache の自動生成エンドポイントで認可が効かない欠陥（CVE-2026-87744・CVSS 9.1）。修正版はまだ確認できていないので、該当エンドポイントの公開範囲を見直してください。 https://cve.autoarticles.net/cve/CVE-2026-87744