CVE-2026-87744: Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Other sources
Title: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations Summary:
A vulnerability in the Quarkus REST Data Panache code generator allows unauthenticated attackers to access improperly secured generated endpoints. When a developer applies a class-level @ResourceProperties(rolesAllowed = ...) annotation to secure a resource, but customizes a specific operation using @MethodProperties without explicitly re-declaring the security roles, the code generator silently drops the class-level security requirement for that specific method. This causes the affected endpoint to default to permissive, unauthenticated access.
Component: io.quarkus:quarkus-hibernate-orm-rest-data-panacheCWE: CWE-285, CWE-862 Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1/10) Affected versions: 3.27, 3.33
Credit: Michael Read (https://github.com/Michael-JRead)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For every operation customized with @MethodProperties, explicitly re-declare the security roles using rolesAllowed so the class-level @ResourceProperties(rolesAllowed = ...) authorization requirement is preserved.
Quarkus REST Data Panache @MethodProperties rolesAllowed = Explicitly re-declare the required security roles
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Quarkus REST Data Panache are exposed when a resource is secured with class-level @ResourceProperties(rolesAllowed = ...) and an individual generated operation is customized with @MethodProperties without explicitly declaring its security roles.
What does an attacker need to exploit the affected endpoint?
An attacker does not need authentication, privileges, or user interaction. They need network access to an affected generated endpoint whose class-level security requirement was dropped during code generation.
How can I identify affected endpoints?
Review REST Data Panache resources that use class-level @ResourceProperties(rolesAllowed = ...) and inspect operations customized with @MethodProperties. Any such operation that does not explicitly redeclare security roles may have permissive unauthenticated access.
What mitigation is available if patching cannot be performed immediately?
Explicitly declare the required security roles on every operation customized with @MethodProperties rather than relying on the class-level @ResourceProperties security annotation.