RESTEasy CVE-2026-89058

Requires the target application to have RESTEasy's CorsFilter explicitly enabled and configured with allowedOrigins set to the wildcard '*' AND allowCredentials=true - this is a non-default developer/operator configuration, not RESTEasy's out-of-the-box behavior. Exploitation further requires (per UI:R) a victim who is already authenticated to the API and who is tricked into visiting an attacker-controlled web page while that session is active; the browser must honor the credentialed cross-origin request. Impact is limited to confidentiality (reading authenticated responses); no integrity or availability effect is described. These gates - non-default wildcard-plus-credentials CORS config and required victim interaction with an active session - meaningfully constrain real-world exploitation despite the network attack vector.

This is a genuine but conditionally-exploitable CORS misconfiguration in RESTEasy's CorsFilter, not a raw-code-execution flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N = 7.4 High) is internally consistent with the description: network-reachable, low complexity, no attacker authentication (the victim supplies their own session), user interaction required (victim must visit a malicious page), scope change (attacker code in victim's browser reads data from a different security authority), and pure confidentiality impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a defensively-reported (Red Hat/RESTEasy GHSA) vulnerability rather than an actively-exploited one. The most important caveat is that the C:H rating assumes the CorsFilter is explicitly deployed with a wildcard allowed-origin ('*') together with allowCredentials=true; this is a developer/operator opt-in, NOT RESTEasy's default behavior, which materially lowers real-world exploitability. Treat this as a targeted, config-dependent info-disclosure issue: patch and audit CORS configuration, but it is not a drop-everything internet-wide worming threat. CWE is 'N/A' in the input; the true class is permissive cross-origin resource sharing / Origin-reflection (CWE-942 / CWE-346), which should be recorded.

A developer configures RESTEasy's CorsFilter to allow all origins ('*') while also sending Access-Control-Allow-Credentials: true. An attacker lures an authenticated victim to a malicious website, whose JavaScript issues credentialed cross-origin fetches to the vulnerable API; because the filter reflects the victim's Origin and permits credentials, the browser lets the attacker's page read the authenticated JSON responses. No public exploit code was provided, but the technique is standard and trivial to script.