REDHAT-BUG-2530524: High severity maven/io.quarkus/quarkus-hibernate-orm-rest-data-panache vulnerability
Title: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations Summary:
A vulnerability in the Quarkus REST Data Panache code generator allows unauthenticated attackers to access improperly secured generated endpoints. When a developer applies a class-level @ResourceProperties(rolesAllowed = ...) annotation to secure a resource, but customizes a specific operation using @MethodProperties without explicitly re-declaring the security roles, the code generator silently drops the class-level security requirement for that specific method. This causes the affected endpoint to default to permissive, unauthenticated access.
Component: io.quarkus:quarkus-hibernate-orm-rest-data-panacheCWE: CWE-285, CWE-862 Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1/10) Affected versions: 3.27, 3.33
Credit: Michael Read (https://github.com/Michael-JRead)
Affected Software
Event History
Frequently Asked Questions
What application pattern is affected?
Applications are affected when a REST Data Panache resource uses class-level @ResourceProperties(rolesAllowed = ...) and an individual operation is customized with @MethodProperties without explicitly declaring security roles for that operation. The generated endpoint for that operation can become unauthenticated.
Does exploitation require an account or user interaction?
No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
How can teams identify potentially exposed endpoints?
Review generated REST Data Panache resources for class-level role restrictions combined with per-operation @MethodProperties declarations that omit roles. Those customized operations are the endpoints that may have lost the intended class-level authorization requirement.