CVE-2023-5675: Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-25 · updated 2026-06-17
Weakness: CWE-285

Description

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.

Affected products

Red Hat A-MQ Clients 2: all versions
Red Hat Cryostat 2: all versions
Red Hat OpenShift Serverless: all versions
Red Hat build of Apicurio Registry 2: all versions
Red Hat build of OptaPlanner 8: all versions
Red Hat build of Quarkus 2.13.9.Final: all versions — fixed in 2.13.9.Final-redhat-00003
Red Hat build of Quarkus 3.2.9.Final: all versions — fixed in 3.2.9.Final-redhat-00003
Red Hat Fuse 7: all versions
Red Hat Integration Camel K 1: all versions
Red Hat Integration Camel Quarkus 2: all versions
Red Hat JBoss Enterprise Application Platform 8: all versions
Red Hat Process Automation 7: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 2.13.9.Final 2.13.9.Final-redhat-00003; Red Hat build of Quarkus 3.2.9.Final 3.2.9.Final-redhat-00003. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5675 or the next vulnerability affects your stack