CVE-2026-19651
Received
Received - Intake
IBM Quarkus Authorization Bypass via URL Manipulation
Vulnerability report for CVE-2026-19651, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-08
Last updated on: 2026-09-08
Assigner: IBM Corporation
Description
Description
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | enterprise_build_of_quarkus | From 3.27.1 (inc) to 3.27.5 (inc) |
| ibm | enterprise_build_of_quarkus | From 3.33.1 (inc) to 3.33.3 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
