{"id":"CVE-2026-111244","kind":"vulnerability","aliases":["CVE-2026-111244"],"related":[],"title":"MicroProfile JWT: role checks let remote callers reach denied JAX-RS resources","description":"When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"When MicroProfile JWT role-based access control is used, JAX-RS resources can skip their declared role constraints: empty role sets allow every caller, inherited methods share constraints, and superclass class-level constraints are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-ee","java","jax-rs","microprofile","package"],"not_affected_if":["no-microprofile-jwt-rbac"],"how_to_check":"- Check whether the application uses MicroProfile JWT RBAC with `@RolesAllowed`, `@DenyAll` or `@PermitAll` on JAX-RS resources.\n- Look for resource classes that inherit methods from a shared superclass or declare empty role sets.\n- Check the MicroProfile JWT implementation version in the build file and compare it with the fixed versions.","fix":"- Upgrade the affected MicroProfile JWT implementation to `10.3.0` or `11.0.0-M2`.","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:24:19+00:00","updated_at":"2026-11-10T16:24:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:24:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the affected MicroProfile JWT implementation to `10.3.0` or `11.0.0-M2`.","reach":"internet","title":"MicroProfile JWT: role checks let remote callers reach denied JAX-RS resources","impact":"high","summary":"When MicroProfile JWT role-based access control is used, JAX-RS resources can skip their declared role constraints: empty role sets allow every caller, inherited methods share constraints, and superclass class-level constraints are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication.","audience":"businesses","category":"package","nicknames":[],"who_cares":["microprofile","jax-rs","java","jakarta-ee"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote callers invoke resources that should be denied to them","analyst_note":"Confirm the affected package name and version ranges from the NVD entry or the project advisory; sources give no product list.","how_to_check":"- Check whether the application uses MicroProfile JWT RBAC with `@RolesAllowed`, `@DenyAll` or `@PermitAll` on JAX-RS resources.\n- Look for resource classes that inherit methods from a shared superclass or declare empty role sets.\n- Check the MicroProfile JWT implementation version in the build file and compare it with the fixed versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-microprofile-jwt-rbac"],"who_is_affected":"Applications that run Jakarta REST (JAX-RS) resources with MicroProfile JWT role-based access control enabled. Systems that do not use MicroProfile JWT RBAC, or that do not rely on role constraints for access, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4620,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111244':16A,19A '-2026':15A,18A '10.3.0':171C '11.0.0':173C 'access':35B,90C,95C,118C 'allow':52B,115C 'alway':104C 'attack':69B,149C 'authent':83B,163C 'base':34B,89C 'caller':7A,54B,121C 'check':4A 'class':62B,123C,138C 'class-level':61B,137C 'common':131C 'configur':81B,161C 'constraint':48B,58B,64B,96C,135C,140C 'control':36B,91C 'cve':14A,17A 'declar':46B,107C,110C,141C 'deni':9A,76B,156C 'ee':22B 'empti':49B,112C 'enforc':105C 'everi':53B,120C 'fix':176C 'ignor':66B,146C 'inherit':55B,125C 'invok':71B,151C 'issu':178C 'jakarta':21B 'jakarta-e':20B 'java':23B 'jax':11A,25B,40B,99C 'jax-r':10A,24B,39B,98C 'jwt':2A,31B,86C 'let':5A 'level':63B,139C 'm2':174C 'method':56B,128C 'microprofil':1A,27B,30B,85C 'packag':28B 'reach':8A 'recommend':166C 'remot':6A,68B,148C 'resourc':13A,42B,72B,101C,108C,122C,152C 'role':3A,33B,47B,50B,88C,116C 'role-bas':32B,87C 'rs':12A,26B,41B,100C 'set':51B,113C 'share':57B,133C 'skip':44B 'superclass':60B,132C,144C 'upgrad':168C 'use':38B,93C 'user':164C 'version':170C 'without':82B,162C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Jakarta REST (JAX-RS) resources with MicroProfile JWT role-based access control enabled. Systems that do not use MicroProfile JWT RBAC, or that do not rely on role constraints for access, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jakartaee","java","jaxrs","microprofile","package"],"campaign_type":null,"search_a":"'-111244':16A,19A '-2026':15A,18A 'caller':7A 'check':4A 'cve':14A,17A 'deni':9A 'jax':11A 'jax-r':10A 'jwt':2A 'let':5A 'microprofil':1A 'reach':8A 'remot':6A 'resourc':13A 'role':3A 'rs':12A","search_b":"'access':35B 'allow':52B 'attack':69B 'authent':83B 'base':34B 'caller':54B 'class':62B 'class-level':61B 'configur':81B 'constraint':48B,58B,64B 'control':36B 'declar':46B 'deni':76B 'ee':22B 'empti':49B 'everi':53B 'ignor':66B 'inherit':55B 'invok':71B 'jakarta':21B 'jakarta-e':20B 'java':23B 'jax':25B,40B 'jax-r':24B,39B 'jwt':31B 'level':63B 'method':56B 'microprofil':27B,30B 'packag':28B 'remot':68B 'resourc':42B,72B 'role':33B,47B,50B 'role-bas':32B 'rs':26B,41B 'set':51B 'share':57B 'skip':44B 'superclass':60B 'use':38B 'without':82B","search_c":"'10.3.0':171C '11.0.0':173C 'access':90C,95C,118C 'allow':115C 'alway':104C 'attack':149C 'authent':163C 'base':89C 'caller':121C 'class':123C,138C 'class-level':137C 'common':131C 'configur':161C 'constraint':96C,135C,140C 'control':91C 'declar':107C,110C,141C 'deni':156C 'empti':112C 'enforc':105C 'everi':120C 'fix':176C 'ignor':146C 'inherit':125C 'invok':151C 'issu':178C 'jax':99C 'jax-r':98C 'jwt':86C 'level':139C 'm2':174C 'method':128C 'microprofil':85C 'recommend':166C 'remot':148C 'resourc':101C,108C,122C,152C 'role':88C,116C 'role-bas':87C 'rs':100C 'set':113C 'share':133C 'superclass':132C,144C 'upgrad':168C 'use':93C 'user':164C 'version':170C 'without':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111244","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}