Quarkus Data Panache EUVD-2026-97766

Exploitation requires that the target application is built on Quarkus REST Data Panache AND that a developer applied @MethodProperties to customize a specific generated operation WITHOUT explicitly re-declaring the class-level security roles on that operation - this specific coding pattern is what causes the generator to silently drop the class-level security requirement and default the endpoint to permissive, unauthenticated access. Applications that either do not use @MethodProperties customization, or that re-declare roles on customized operations, are NOT exposed. Limiting factor: the vulnerable state is determined at development/build time and is not attacker-controlled, so impact is scoped to deployments matching this exact pattern; once such an endpoint exists, however, no authentication, privileges, or user interaction are needed to reach it (AV:N/PR:N/UI:N).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) yields a 9.1 Critical score driven by network-reachable, unauthenticated access with high confidentiality and integrity impact, which aligns with CWE-425 (Direct/Forced Browsing to a protected endpoint). However, the real-world risk is strongly gated by a specific build-time condition that the raw score does not capture: the flaw only manifests when a developer uses @MethodProperties to customize an operation on a REST Data Panache resource WITHOUT re-declaring the class-level security roles. This is a non-attacker-controlled development/configuration precondition, so while any given vulnerable endpoint is trivially exploitable by an unauthenticated remote attacker, not all Quarkus deployments are affected - only those matching this coding pattern. No EPSS score was provided; there is no CISA KEV listing and no public POC in the supplied data, so there is no public exploit identified at time of analysis. Net assessment: this is a genuine high-priority issue for shops using REST Data Panache with customized secured endpoints (the bypass is silent and leads to data exposure/modification by default), but it is not evidence of widespread opportunistic exploitation; prioritize code audit and patching where the affected pattern is in use rather than treating it as an actively-exploited emergency.

A developer secures a REST Data Panache resource at the class level (e.g., requiring an authenticated role) and then customizes one operation with @MethodProperties without re-declaring the roles; the generator silently drops the class-level requirement for that endpoint. An unauthenticated remote attacker who discovers or guesses the generated endpoint URL simply sends a direct HTTP request (no credentials, no user interaction) and reads or modifies data that should have been access-controlled. No public exploit code is identified at time of analysis, but the attack requires only a standard HTTP client.