CVE-2026-19651CWE-639

CVE-2026-19651

High · published September 9, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-09T01:17Z
References (1)
https://www.ibm.com/support/pages/node/7286498 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 08 SEP 20:14Z
    IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
    cvelistv5