7.4
High
CVE-2026-19651 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass…
Description
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enterprise Build of Quarkus 3.33 | 3.33.1 → 3.33.3 | No fix stated |
| Enterprise Build of Quarkus 3.27 | 3.27.1 → 3.27.5 | No fix stated |
Other CVEs of Enterprise Build of Quarkus
The 4 CVEs of Enterprise Build of Quarkus →
CVE-2026-77874
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection
8.6
High
CVE-2026-19625
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1"…
5.3
Medium
CVE-2026-16308
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a…
7.5
High