4.3
Medium
CVE-2026-121837 Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
Description
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Exploit Intelligence | Versions not published | |
| Red Hat build of Quarkus | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2566744 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Exploit Intelligence
The 29 CVEs of Exploit Intelligence →
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache
9.1
Critical
CVE-2026-94451
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities
6.5
Medium