CVE-2026-19651

CVE-2026-19651 is an authorization bypass (CWE-639) in the IBM Enterprise Build of Quarkus, IBM's commercially supported distribution of the open-source Quarkus Java framework, caused by incorrect mapping of values to untrusted query string input. A remote, unauthenticated attacker can manipulate URL query parameters on protected endpoints so that authorization checks are evaluated against the wrong values, gaining access to resources the application's security configuration should deny (CVSS high confidentiality and integrity impact, no availability impact). The high attack-complexity score (AC:H) indicates that successful exploitation depends on application-specific conditions, such as how an app's path- or role-based authorization rules interact with query parameters, so not every deployment is equally exposed. Affected organizations are those running IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 or 3.33.1 through 3.33.3. There is no evidence of exploitation in the wild, no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.3%.

What to do: Update to the latest IBM Enterprise Build of Quarkus release in your stream — newer than 3.27.5 on the 3.27 line or newer than 3.33.3 on the 3.33 line — and confirm the exact fixed micro-version in IBM's security bulletin. In the meantime, review applications for authorization rules that key on URL query parameters (e.g., path-based security policies) and limit direct internet exposure of affected REST endpoints. Given the low EPSS score and no known public PoC, patching in the normal cycle is reasonable, but prioritize internet-facing services that enforce path-based authorization.