Quarkus CVE-2023-6394

Requires a Quarkus application using the SmallRye GraphQL extension that exposes the GraphQL endpoint over websocket (e.g., GraphQL subscriptions), where at least one GraphQL operation has NO role-based permission (e.g., missing @RolesAllowed/@Authenticated on that operation) even though the endpoint is otherwise secured. Exploitation is limited to applications matching this configuration: if every operation carries an explicit role-based permission, or if the GraphQL-over-websocket transport is not enabled/exposed, the flaw is not reachable. No authentication or user interaction is needed once such an endpoint is exposed (PR:N/UI:N, AV:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) presents this as a critical, network-reachable, unauthenticated authorization bypass with high confidentiality and integrity impact and no availability impact - consistent with the CWE-862 (Missing Authorization) classification. However, the real-world signals temper that headline severity: EPSS is only 0.54% (67th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided sources, so exploitation status is 'no public exploit identified at time of analysis.' The high base score is driven by the theoretical worst case, but actual impact is strongly gated by a narrow precondition (see exploitation_conditions): the vulnerability only manifests for GraphQL operations that lack a role-based permission while being reached over websocket. This makes it a real-but-conditional issue rather than a mass-exploitable one - a security fix worth prioritizing where Quarkus SmallRye GraphQL subscriptions are exposed, but not an emergency for most deployments. No conflicting signals in the CVSS vector versus description (both indicate remote/network, unauthenticated); the main uncertainty is that the C:H/I:H impact is application-data-dependent and A:N is appropriate since no availability effect is described.

An attacker who can reach a Quarkus application exposing a SmallRye GraphQL endpoint over websocket sends GraphQL operations that were not annotated with a role-based permission; because the websocket path skips the expected authentication despite the endpoint being secured, the attacker reads data or invokes functionality outside their granted API permissions. No authentication or user interaction is required (PR:N/UI:N). No public proof-of-concept exploit was identified in the provided intelligence.