Description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Quarkus 3.27.6.redhat
Default version status: affected
3.27.6.redhat-00004 to < *unaffected
Red Hat Red Hat build of Quarkus 3.33.4.redhat
Default version status: affected
3.33.4.redhat-00004 to < *unaffected
Red Hat Exploit Intelligence
Default version status: affected