REDHAT-BUG-2566744: Security vulnerability

Published Nov 4, 2026

Updated

A vulnerability was found in io.quarkus:quarkus-rest-data-panache where getter-level @SecureField annotations are ignored during the generation of filter and sort logic for REST Data Panache resources. When @SecureField(rolesAllowed = ...) is placed on a property getter, the generated list endpoint does not check for the required roles when processing filter (?field=value) or sort (?sort=field) parameters. While the sensitive values are correctly masked in the resulting JSON response, an attacker with access to the endpoint can perform the following actions: Determine if any records match a specific sensitive value by using filter parameters.

Determine the relative ordering of records based on the sensitive field using sort parameters.

Systematically infer sensitive values through repeated targeted filtering.

This issue only affects @SecureField when placed on the getter; placing the annotation directly on the field is not affected.

Affected Software

0 affected components

Event History

Nov 4, 2026

Data Sourced

via Red Hat·07:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs access to a REST Data Panache list endpoint that exposes filtering or sorting for an entity with a sensitive property. The issue is limited to properties where @SecureField(rolesAllowed = ...) is applied to the getter rather than directly to the field.

What information can be disclosed if JSON responses still mask the sensitive field?

An attacker can test whether records match a chosen sensitive value through filter parameters and can infer the relative ordering of records through sort parameters. Repeated, targeted filter requests may allow systematic inference of sensitive values.

What configuration change can mitigate the issue if patching is not immediately possible?

Place the @SecureField annotation directly on the field instead of on the property getter. Field-level @SecureField annotations are not affected by this issue.

REDHAT-BUG-2566744: Security vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed if JSON responses still mask the sensitive field?

What configuration change can mitigate the issue if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed if JSON responses still mask the sensitive field?

What configuration change can mitigate the issue if patching is not immediately possible?