Security Control Bypass in Quarkus REST Data Panache via @MethodProperties

CVE-2026-87744 describes a security vulnerability within the Quarkus REST Data Panache extension. The flaw originates in the code generation process during the application build phase. When a developer utilizes the @MethodProperties annotation to customize a specific REST operation, the generator fails to carry over existing class-level security constraints to the generated endpoint. Unless a developer explicitly re-declares security roles for the customized operation, the generator silently defaults the endpoint to permissive, unauthenticated access. This misconfiguration exposes sensitive application interfaces to any remote, unauthenticated user, facilitating potential unauthorized information disclosure or arbitrary data modification depending on the functionality of the exposed resource. The vulnerability impacts applications relying on Quarkus REST Data Panache for automated endpoint exposure.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.1, representing a high risk of unauthorized access to sensitive application data. Exploitation is possible by any remote unauthenticated attacker who identifies affected endpoints that were improperly customized. Successful exploitation allows for unauthorized data access or modification, potentially impacting the confidentiality and integrity of backend data stores.

Recommendation

• Conduct an audit of all Quarkus projects utilizing the REST Data Panache extension to identify endpoints where @MethodProperties is in use.
• Verify that any operation customized with @MethodProperties explicitly includes security annotations (such as @RolesAllowed) to re-enforce access controls.
• Update Quarkus REST Data Panache to the version containing the fix once released by the vendor, and rebuild the application to ensure the code generator correctly applies security policies.