A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enable
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed'…
| Vendor | Product | Versions |
|---|---|---|
| ? | ? | 3.2.0, 3.6.0, 3.7.0, 3.8.0 |
| Red Hat | Red Hat build of Quarkus 2.13.9.Final | 2.13.9.Final-redhat-00003 |
| Red Hat | Red Hat build of Quarkus 2.13.9.Final | 2.13.9.Final-redhat-00003 |
| Red Hat | Red Hat build of Quarkus 3.2.9.Final | 3.2.9.Final-redhat-00003 |
| Red Hat | Red Hat build of Quarkus 3.2.9.Final | 3.2.9.Final-redhat-00003 |
| Red Hat | A | MQ Clients 2 — unspecified |
| Red Hat | Cryostat 2 | unspecified |
| Red Hat | OpenShift Serverless | unspecified |
| Red Hat | Red Hat build of Apicurio Registry 2 | unspecified |
| Red Hat | Red Hat build of OptaPlanner 8 | unspecified |
| Red Hat | Red Hat Fuse 7 | unspecified |
| Red Hat | Red Hat Integration Camel K 1 | unspecified |
| Red Hat | Red Hat Integration Camel Quarkus 2 | unspecified |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | unspecified |
| Red Hat | Red Hat Process Automation 7 | unspecified |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.