CVE-2026-19651 PUBLISHED

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 12.08.2026 Published: 08.09.2026 Updated: 08.09.2026

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Enterprise Build of Quarkus
Versions	affected from 3.27.1 to 3.27.5 (incl.) affected from 3.33.1 to 3.33.3 (incl.)

Solutions

The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .

Credits

Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead) finder

References

https://www.ibm.com/support/pages/node/7286498

Problem Types

CWE-639 Authorization Bypass Through User-Controlled Key CWE