Advisoriesby IbisIBMCVE-2026-19651
IBM Enterprise Build of Quarkus: insecure direct object reference
No fix yet
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Enterprise Build of Quarkus Product | >= 3.27.1, <= 3.27.5 | No fix yet |
| >= 3.33.1, <= 3.33.3 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-639