CVE-2026-111244
Received Received - Intake

MicroProfile JWT RBAC Access Bypass in Quarkus

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Apache Software Foundation

Description
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-111244
EUVD
EUVD-2026-121247

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache microprofile_jwt 10.3.0
apache microprofile_jwt 11.0.0-m2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MicroProfile JWT role-based access control. It allows unauthorized access to JAX-RS resources due to improper enforcement of access constraints. Resources with empty role sets are accessible to all users, class-level constraints on superclasses are ignored, and inherited methods share constraints incorrectly. Attackers can exploit this to access protected resources without proper authentication.

Impact Analysis

If you use MicroProfile JWT for role-based access control, attackers may bypass authentication and authorization checks. This could lead to unauthorized access to sensitive data or functions in your application. The impact depends on the application's configuration and exposed resources.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and authentication, such as GDPR's data protection principles or HIPAA's access safeguards. Unauthorized access risks could lead to regulatory penalties or data breaches.

Mitigation Strategies

Upgrade to MicroProfile JWT version 10.3.0 or 11.0.0-M2 to fix the issue. Review JAX-RS resource access constraints to ensure proper role-based enforcement.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...