EUVD-2026-74180Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-delivered query parameter manipulation with no credential required; AC:H reflects need to know valid object keys; no availability impact as only data access/modification is affected.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
3DescriptionCVE.org
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
AnalysisAI
Authorization bypass in IBM Enterprise Build of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 allows unauthenticated network attackers to access or modify resources belonging to other users or roles by manipulating URL query parameters. The root cause (CWE-639) is incorrect mapping of user-controlled query string values to authorization decisions, enabling an attacker to substitute an arbitrary object key and have the application honor the substituted identity without re-validating access rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to send HTTP requests to an IBM Enterprise Build of Quarkus application endpoint in versions 3.27.1-3.27.5 or 3.33.1-3.33.3 that resolves a resource using a user-controlled URL query parameter as a key. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rates this 7.4 Medium-High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the IBM advisory at https://www.ibm.com/support/pages/node/7286498 for patched version guidance; the input data does not specify an exact fixed version beyond the affected ranges (3.27.1-3.27.5 and 3.33.1-3.33.3), so upgrading outside those ranges to the next available release in the respective stream is the primary recommended action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately inventory all deployments of Quarkus 3.27.1-3.27.5 and 3.33.1-3.33.3 across your infrastructure and identify which instances are network-accessible or internet-facing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today