CVE-2026-39852 is an incorrect authorization vulnerability (CWE-863) in the Quarkus Java framework. It arises from inconsistent path normalization between the security layer and RESTEasy Reactive routing layer. The security layer authorizes based on the raw URL path, which includes matrix parameters (semicolon-separated segments), whereas the routing layer removes these parameters before endpoint matching. This discrepancy enables unauthorized users to bypass HTTP path-based authorization policies by appending a semicolon and arbitrary text to URLs, effectively accessing protected endpoints without proper authorization. The issue affects multiple Quarkus versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, where it has been fixed.

The vulnerability allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization controls, potentially granting unauthorized access to protected endpoints. This can lead to exposure of sensitive functionality or data within applications built on affected Quarkus versions. The CVSS 4.0 score of 8.8 reflects a high severity impact with network attack vector, no required privileges or user interaction, and high confidentiality impact.

Fixed versions of Quarkus are available: 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2. Users should upgrade to one of these versions to remediate the vulnerability. Patch status is not explicitly confirmed beyond these fixed versions; therefore, verify with the official Quarkus vendor advisory for the latest remediation guidance.