{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/configuration-flaw/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:quarkus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-87744"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Quarkus REST Data Panache"],"_cs_severities":["critical"],"_cs_tags":["web-application-security","configuration-flaw","cve-2026-87744"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-87744 describes a security vulnerability within the Quarkus REST Data Panache extension. The flaw originates in the code generation process during the application build phase. When a developer utilizes the @MethodProperties annotation to customize a specific REST operation, the generator fails to carry over existing class-level security constraints to the generated endpoint. Unless a developer explicitly re-declares security roles for the customized operation, the generator silently defaults the endpoint to permissive, unauthenticated access. This misconfiguration exposes sensitive application interfaces to any remote, unauthenticated user, facilitating potential unauthorized information disclosure or arbitrary data modification depending on the functionality of the exposed resource. The vulnerability impacts applications relying on Quarkus REST Data Panache for automated endpoint exposure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS 3.1 base score of 9.1, representing a high risk of unauthorized access to sensitive application data. Exploitation is possible by any remote unauthenticated attacker who identifies affected endpoints that were improperly customized. Successful exploitation allows for unauthorized data access or modification, potentially impacting the confidentiality and integrity of backend data stores.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eConduct an audit of all Quarkus projects utilizing the REST Data Panache extension to identify endpoints where @MethodProperties is in use.\u003c/li\u003e\n\u003cli\u003eVerify that any operation customized with @MethodProperties explicitly includes security annotations (such as @RolesAllowed) to re-enforce access controls.\u003c/li\u003e\n\u003cli\u003eUpdate Quarkus REST Data Panache to the version containing the fix once released by the vendor, and rebuild the application to ensure the code generator correctly applies security policies.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:37:47Z","date_published":"2026-10-12T22:37:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-quarkus-security-bypass/","summary":"A code generation flaw in Quarkus REST Data Panache allows unauthenticated attackers to bypass class-level security requirements when using @MethodProperties without explicit role re-declaration.","title":"Security Control Bypass in Quarkus REST Data Panache via @MethodProperties","url":"https://feed.craftedsignal.io/briefs/2026-10-quarkus-security-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Configuration-Flaw","version":"https://jsonfeed.org/version/1.1"}