{"id":"CVE-2026-19651","state":"PUBLISHED","title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","description":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.","publishedAt":"2026-09-08T20:14:12.902Z","updatedAt":"2026-09-09T13:27:49.159Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Enterprise Build of Quarkus"],"affected":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","versions":[{"version":"3.27.1","status":"affected","lessThanOrEqual":"3.27.5","versionType":"semver"},{"version":"3.33.1","status":"affected","lessThanOrEqual":"3.33.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7286498"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19651.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19651","state":"PUBLISHED","datePublished":"2026-09-08T20:14:12.902Z","dateUpdated":"2026-09-09T13:27:49.159Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-08-12T17:38:20.473Z"},"containers":{"cna":{"title":"IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities","descriptions":[{"lang":"en","value":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3  could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input."}],"affected":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","versions":[{"version":"3.27.1","status":"affected","lessThanOrEqual":"3.27.5","versionType":"semver"},{"version":"3.33.1","status":"affected","lessThanOrEqual":"3.33.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7286498","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.4,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"CWE-639 Authorization Bypass Through User-Controlled Key","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-09-08T20:14:12.902Z"},"solutions":[{"lang":"en","value":"The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the  product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the <a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>"}]}],"credits":[{"lang":"en","value":"Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead)","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-09T13:27:41.882596Z","id":"CVE-2026-19651","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-09T13:27:49.159Z"}}]}}}