# CVE-2026-19651: IBM Enterprise Build of Quarkus authorization bypass in Spring Web

Source: https://junglewise.ai/threats/cve-2026-19651-ibm-enterprise-build-of-quarkus-authorization-bypass-in-spring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19651 · Severity: high · CVSS 7.4 · Published 2026-09-08

IBM Enterprise Build of Quarkus is a Java framework used to build cloud-native applications. A vulnerability in the Spring Web extension allows attackers to bypass authorization checks by manipulating URL query parameters, potentially granting unauthorized access to protected resources. This could expose sensitive data or allow unauthorized operations on affected applications.

Technologies: [IBM Enterprise Build of Quarkus](https://junglewise.ai/threats/technologies/enterprise-build-of-quarkus). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-19651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19651 being exploited in the wild.

**How severe is CVE-2026-19651?** High severity, with a CVSS score of 7.4, published 8 September 2026.

**Which products and versions are affected?** IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3.

**Is there a fix for CVE-2026-19651?** A patch was published on 2026-09: Fixed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19651 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19651?** Check whether you run IBM Enterprise Build of Quarkus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CVE-2026-19651) is an authorization bypass flaw in the Quarkus quarkus-spring-web extension caused by incorrect mapping of URL query string input to trusted values (CWE-639). An unauthenticated attacker can craft malicious query parameters to bypass authorization checks over the network with moderate complexity. Successful exploitation grants unauthorized access to protected application endpoints. The issue affects IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3; patches are available in 3.27.5.SP1 and 3.33.3.SP1.

## Affected products

- IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3

## Timeline

- 2026-09-08: disclosed
- 2026-09: patched: Fixed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1

## References

- [https://www.ibm.com/support/pages/node/7286498](https://www.ibm.com/support/pages/node/7286498)

## Related threats

- [IBM Enterprise Build of Quarkus SQL injection in Hibernate](https://junglewise.ai/threats/cve-2026-77874-ibm-enterprise-build-of-quarkus-3-27-1-through-3-27-5-sp1-and-3)
- [Quarkus OIDC token introspection cache authorization bypass](https://junglewise.ai/threats/cve-2026-19625-quarkus-oidc-token-introspection-cache-authorization-bypass)
- [IBM Enterprise Build of Quarkus denial of service in Quarkus REST](https://junglewise.ai/threats/cve-2026-16308-ibm-enterprise-build-of-quarkus-denial-of-service-in-quarkus-rest)