CVE-2026-121837 · Package
NO FIX YET
When a field is protected with @SecureField on its getter instead of the field, the generated REST resource does not enforce that protection during filtering and sorting. An authenticated user can infer hidden values by seeing which records match a filter or how results are ordered.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built on Quarkus REST Data Panache that place @SecureField on a getter method and expose filtering or sorting on those entities. Applications that put @SecureField on the field itself, or do not use Data Panache REST generation, are not described as affected. The sources do not list affected versions.
Not affected if field-level-annotation, no-data-panache-rest
Who cares java, quarkus, rest-data-panache
Unknown from the sources.
Unknown from the sources.
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.