CVE-2026-87744: Direct Request ('Forced Browsing') in Red Hat Exploit Intelligence

This vulnerability arises from a flaw in the Quarkus REST Data Panache code generation process. Specifically, when a developer customizes an operation using the @MethodProperties annotation but does not explicitly re-declare security roles, the security constraints defined at the class level are silently ignored. Consequently, the affected REST endpoints become accessible without authentication or authorization, exposing sensitive data or allowing unauthorized data changes. The vulnerability affects Red Hat Exploit Intelligence and is tracked as CVE-2026-87744 with a CVSS 3.1 score of 9.1, indicating critical severity.

Unauthenticated attackers can bypass security controls on affected endpoints, potentially leading to unauthorized disclosure of sensitive information or unauthorized modification of data. The vulnerability compromises confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-87744 for current remediation guidance. Until a fix is applied, developers should ensure that when customizing operations with @MethodProperties, security roles are explicitly re-declared to maintain intended access controls.