Executive brief
IBM Enterprise Build of Quarkus is a Java framework used to build cloud-native applications. A vulnerability in the Spring Web extension allows attackers to bypass authorization checks by manipulating URL query parameters, potentially granting unauthorized access to protected resources. This could expose sensitive data or allow unauthorized operations on affected applications.
Technical details
The vulnerability (CVE-2026-19651) is an authorization bypass flaw in the Quarkus quarkus-spring-web extension caused by incorrect mapping of URL query string input to trusted values (CWE-639). An unauthenticated attacker can craft malicious query parameters to bypass authorization checks over the network with moderate complexity. Successful exploitation grants unauthorized access to protected application endpoints. The issue affects IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3; patches are available in 3.27.5.SP1 and 3.33.3.SP1.
Affected products
- IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3
Timeline
- 2026-09-08: disclosed
- 2026-09: patched: Fixed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1