{"id":"CVE-2026-121837","kind":"vulnerability","aliases":["CVE-2026-121837"],"related":[],"title":"Quarkus REST Data Panache: filter and sort leak hidden field values","description":"A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.","summary":"When a field is protected with @SecureField on its getter instead of the field, the generated REST resource does not enforce that protection during filtering and sorting. An authenticated user can infer hidden values by seeing which records match a filter or how results are ordered.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","quarkus","rest-data-panache"],"not_affected_if":["field-level-annotation","no-data-panache-rest"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:39+00:00","updated_at":"2026-11-06T06:41:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quarkus REST Data Panache: filter and sort leak hidden field values","impact":"low","summary":"When a field is protected with @SecureField on its getter instead of the field, the generated REST resource does not enforce that protection during filtering and sorting. An authenticated user can infer hidden values by seeing which records match a filter or how results are ordered.","audience":"businesses","category":"package","nicknames":[],"who_cares":["quarkus","java","rest-data-panache"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user infers hidden field values via filter and sort","analyst_note":"Find the affected and fixed Quarkus versions for the REST Data Panache component in the Quarkus security advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121837.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["field-level-annotation","no-data-panache-rest"],"who_is_affected":"Applications built on Quarkus REST Data Panache that place @SecureField on a getter method and expose filtering or sorting on those entities. Applications that put @SecureField on the field itself, or do not use Data Panache REST generation, are not described as affected. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4250,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121837':14A,17A '-2026':13A,16A 'allow':121C 'annot':96C 'appli':88C 'authent':53B,123C 'compon':80C 'constraint':86C,114C 'criteria':137C 'cve':12A,15A 'data':3A,23B,78C,128C 'enforc':45B,112C 'entiti':91C 'even':143C 'fail':110C 'field':10A,27B,38B,104C 'filter':5A,49B,65B,116C,136C 'final':151C 'flaw':72C 'found':74C 'generat':40B,107C 'getter':34B,99C 'hidden':9A,57B 'infer':56B,126C 'instead':35B 'java':18B 'leak':8A 'match':63B,134C 'method':100C 'observ':131C 'omit':148C 'oper':119C 'order':70B,142C 'packag':19B 'panach':4A,24B,79C 'properti':92C 'protect':29B,47B 'quarkus':1A,20B,82C 'rather':101C 'record':62B,133C 'resourc':42B,109C 'respons':152C 'rest':2A,22B,41B,77C,108C 'rest-data-panach':21B 'result':68B 'secur':85C 'securefield':31B,95C 'see':60B 'sensit':127C 'sort':7A,51B,118C 'specif':135C 'though':144C 'use':93C 'user':54B,124C 'valu':11A,58B,129C,146C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Quarkus REST Data Panache that place @SecureField on a getter method and expose filtering or sorting on those entities. Applications that put @SecureField on the field itself, or do not use Data Panache REST generation, are not described as affected. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","package","quarkus","restdatapanache"],"campaign_type":null,"search_a":"'-121837':14A,17A '-2026':13A,16A 'cve':12A,15A 'data':3A 'field':10A 'filter':5A 'hidden':9A 'leak':8A 'panach':4A 'quarkus':1A 'rest':2A 'sort':7A 'valu':11A","search_b":"'authent':53B 'data':23B 'enforc':45B 'field':27B,38B 'filter':49B,65B 'generat':40B 'getter':34B 'hidden':57B 'infer':56B 'instead':35B 'java':18B 'match':63B 'order':70B 'packag':19B 'panach':24B 'protect':29B,47B 'quarkus':20B 'record':62B 'resourc':42B 'rest':22B,41B 'rest-data-panach':21B 'result':68B 'securefield':31B 'see':60B 'sort':51B 'user':54B 'valu':58B","search_c":"'allow':121C 'annot':96C 'appli':88C 'authent':123C 'compon':80C 'constraint':86C,114C 'criteria':137C 'data':78C,128C 'enforc':112C 'entiti':91C 'even':143C 'fail':110C 'field':104C 'filter':116C,136C 'final':151C 'flaw':72C 'found':74C 'generat':107C 'getter':99C 'infer':126C 'match':134C 'method':100C 'observ':131C 'omit':148C 'oper':119C 'order':142C 'panach':79C 'properti':92C 'quarkus':82C 'rather':101C 'record':133C 'resourc':109C 'respons':152C 'rest':77C,108C 'secur':85C 'securefield':95C 'sensit':127C 'sort':118C 'specif':135C 'though':144C 'use':93C 'user':124C 'valu':129C,146C","first_public_at":"2026-11-06T06:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121837","severity":null,"published_at":"2026-11-06T06:16:42+00:00","modified_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}