{"id":"CVE-2026-73099","kind":"vulnerability","aliases":["CVE-2026-73099"],"related":[],"title":"Apache Juneau: a crafted link replaces request bodies, bypassing CSRF protections","description":"Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.\n\nThe REST server accepts a \"content\" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.","summary":"Apache Juneau's REST server accepts a \"content\" query parameter that replaces the request body, enabled by default on every HTTP method including GET. A cross-site link can therefore send an attacker-chosen body to an endpoint without a CORS preflight, defeating method- or content-type-based CSRF protection.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","package","rest-api"],"not_affected_if":["disablecontentparam-set","juneau-after-9.2.1","no-browser-clients"],"how_to_check":"- Check the Juneau version in the project's build file against `9.2.0` and earlier.\n- Search application config for `disableContentParam` to see whether it is set to `true`.","fix":"- Apache Juneau: upgrade to `9.2.1`.\n- Applications that do not use the content parameter can set `disableContentParam` to `true`.","status":"open","published_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:05+00:00","updated_at":"2026-11-05T12:40:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T12:40:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.\n- Applications that do not use the content parameter can set `disableContentParam` to `true`.","reach":"internet","title":"Apache Juneau: a crafted link replaces request bodies, bypassing CSRF protections","impact":"medium","summary":"Apache Juneau's REST server accepts a \"content\" query parameter that replaces the request body, enabled by default on every HTTP method including GET. A cross-site link can therefore send an attacker-chosen body to an endpoint without a CORS preflight, defeating method- or content-type-based CSRF protection.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-juneau","rest-api"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen request bodies reach endpoints through victims' browsers","analyst_note":"","how_to_check":"- Check the Juneau version in the project's build file against `9.2.0` and earlier.\n- Search application config for `disableContentParam` to see whether it is set to `true`.","plain_action":"","needs_analyst":false,"not_affected_if":["juneau-after-9.2.1","no-browser-clients","disableContentParam-set"],"who_is_affected":"Applications built on Apache Juneau through 9.2.0 that expose the REST server to browsers are exposed, since the content parameter is on by default for all methods. Services that do not use the content parameter can set disableContentParam to true. Services that never run a Juneau REST server are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000723,"input_tokens":4339,"output_tokens":578,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-73099':14A,17A '9.2.0':159C '9.2.1':167C 'accept':31B,92C 'affect':155C 'also':181C 'anti':150C 'anti-csrf':149C 'apach':1A,19B,26B,87C,156C 'apache-juneau':18B 'api':25B 'applic':172C 'attack':60B,124C 'attacker-chosen':59B,123C 'base':76B 'bodi':8A,40B,62B,101C,127C 'bypass':9A 'chosen':61B,125C 'content':33B,74B,94C,144C,178C 'content-type-bas':73B 'cor':68B,133C 'craft':4A 'cross':52B,80C,116C 'cross-sit':51B,79C,115C 'csrf':10A,77B,84C,151C 'cve':12A,15A 'default':43B,107C 'defeat':70B,135C 'deliv':121C 'disablecontentparam':183C 'enabl':41B,105C 'endpoint':65B,130C 'everi':45B,109C 'fix':169C 'forgeri':83C 'get':49B,113C 'http':46B,110C,141C 'includ':48B,112C 'instead':146C 'issu':154C,171C 'java':21B 'juneau':2A,20B,27B,88C,157C 'link':5A,54B,118C 'method':47B,71B,111C,142C 'packag':22B 'paramet':35B,96C,179C 'preflight':69B,134C 'protect':11A,78B,136C 'queri':34B,95C 'recommend':162C 'reli':138C 'replac':6A,37B,98C 'request':7A,39B,82C,100C,126C 'rest':24B,29B,90C 'rest-api':23B 'send':57B 'server':30B,91C 'set':182C 'site':53B,81C,117C 'therefor':56B,120C 'token':152C 'true':185C 'type':75B,145C 'upgrad':164C 'use':176C 'user':160C 'version':166C 'vulner':85C 'without':66B,131C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Juneau through 9.2.0 that expose the REST server to browsers are exposed, since the content parameter is on by default for all methods. Services that do not use the content parameter can set disableContentParam to true. Services that never run a Juneau REST server are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","java","package","restapi"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73099","severity":null,"published_at":"2026-11-05T12:17:50+00:00","modified_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}