CVE-2026-87744

Summary

Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints when developers use @MethodProperties without re-declaring security roles, causing class-level security requirements to be silently dropped and endpoints to default to unauthenticated access.

Exploitability

Very easy to exploit with no preconditions; attackers can simply call the affected endpoints without authentication to gain unauthorized access.

Blast radius

High impact across all applications using Quarkus REST Data Panache with customized operations that don't explicitly redeclare security roles, potentially exposing sensitive data or allowing unauthorized modifications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Quarkus 3.15.0 or later, which contains the fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.