Apache Juneau CVE-2026-73099

The content query-parameter body override is enabled by default (disableContentParam=false) and, in versions through 9.2.0, was honored on every HTTP method including GET - so no non-default configuration is needed on the Juneau side. Exploitation requires: (1) a victim with an authenticated/relevant session who performs user interaction by visiting an attacker-controlled page or loading an attacker-controlled resource; and (2) the target application exposing state-changing endpoints that rely on HTTP method or content-type expectations rather than anti-CSRF tokens. Limiting factors: requires victim interaction, is only useful against endpoints lacking token-based CSRF protection, and the mitigation (set disableContentParam=true, or upgrade to 9.2.1 which restricts the override to PUT/POST) removes the exposure.

No CVSS vector, EPSS score, KEV entry, or SSVC decision framework is provided in the input; the vuln.today Decision label is 'awaiting_data', and no PoC or exploit reference is present, so this is 'no public exploit identified at time of analysis'. The ASF rates it 'important'. The flaw is a CSRF: the REST server's content query parameter, which replaces the request body, was enabled by default (disableContentParam=false) and, before the fix, honored on every HTTP method including GET - letting a cross-site link or embedded resource deliver an attacker-chosen body with no CORS preflight and without the endpoint's expected content type, defeating protections that rely on method or content type rather than an anti-CSRF token. This is a real design-level weakness because it is default-on and remotely reachable, but impact is bounded by requiring victim interaction and by the target application having sensitive state-changing endpoints that depend on method/content-type checks rather than CSRF tokens. Absent EPSS/KEV/CVSS this cannot be ranked as a confirmed high-priority emergency; treat as a meaningful hardening fix whose real-world severity is application-dependent. Note the input supplies no machine CVSS vector (CVSS Score: N/A), so authentication/attack-vector metrics below are independently assessed, not vendor-confirmed.

A logged-in user of a Juneau-based application is lured to an attacker-controlled page that triggers a cross-site request (e.g. a GET link or auto-loading resource) to a Juneau REST endpoint with a crafted content query parameter supplying the request body. Because the override was honored on all methods and enabled by default, the forged body reaches the endpoint without a CORS preflight or the normally-required content type, bypassing method/content-type-based CSRF defenses. No public PoC or exploit code is identified at time of analysis.