CVE-2026-87744 Missing authorization in Exploit Intelligence
Unauthenticated attackers can access protected endpoints if developers customize operations without re-declaring security roles, leading to unauthorized data access or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87744?
CVE-2026-87744 is a critical missing authorization vulnerability in Red Hat Exploit Intelligence, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Weakness: CWE-425
Which versions are affected by CVE-2026-87744?
How do I fix CVE-2026-87744?
No fix has been published for CVE-2026-87744 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-87744 being exploited?
There is no known exploitation of CVE-2026-87744 in the wild and no public exploit code.
Sources
Also known as GHSA-jh67-c59w-8h9x.