Quarkus versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 contain a CWE-863 Incorrect Authorization vulnerability due to a path normalization inconsistency. The security layer authorizes requests based on the raw URL path including matrix parameters (semicolon and following text), while the RESTEasy Reactive routing layer strips these parameters before endpoint matching. This discrepancy allows attackers to append a semicolon and arbitrary text to URLs (e.g., /api/admin;anything) to bypass authorization policies protecting sensitive endpoints. The vulnerability has a CVSS 4.0 score of 8.8 (high severity), indicating network attack vector, no privileges or user interaction required, and high impact on confidentiality. The issue is fixed in the specified patched versions.

An attacker can bypass HTTP path-based authorization policies in affected Quarkus versions by exploiting the path normalization inconsistency, potentially gaining unauthorized access to protected endpoints. This can lead to unauthorized information disclosure or unauthorized actions within applications using vulnerable Quarkus versions. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network.

The vulnerability has been fixed in Quarkus versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2. Users should upgrade to one of these patched versions to remediate the issue. Patch status is not explicitly confirmed beyond these fixed versions; therefore, verify with official Quarkus advisories for the latest remediation guidance. No other vendor mitigation or temporary fixes are indicated.