Description

A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-06T06:16:42.067Z",
  "pubdate": "2026-11-06T06:16:42.067Z",
  "executiveSummary": "This vulnerability involves an improper security constraint enforcement within the Quarkus REST Data Panache component. Specifically, the framework fails to honor the @SecureField annotation when applied to a getter method instead of the underlying entity field.\nThe flaw allows authenticated attackers to perform unauthorized data inference. By crafting filter and sort queries against REST endpoints, an attacker can determine the existence or value of restricted data points based on query outcomes, such as record visibility or ordering, even though the data remains redacted in the API response.\nThe vulnerability affects applications utilizing REST Data Panache to expose entities with field-level security. Risk is significant as it facilitates unauthorized sensitive information disclosure through side-channel query analysis.\nExploitation requires authenticated access to the affected REST endpoint. No specialized privileges are inherently required beyond the ability to submit filtered and sorted requests to the vulnerable resource.",
  "technicalDetails": "The vulnerability originates in the code generation process of the Quarkus REST Data Panache component. When the library generates REST resources, it parses entity metadata to determine if security constraints apply. The generation logic is improperly configured to only respect the @SecureField annotation when it is explicitly placed on the entity field member. If a developer secures a field by annotating its corresponding getter method, the generation logic fails to propagate this security constraint into the generated REST resource.\nThe root cause is a deficiency in the annotation processing logic during the build-time generation of Panache REST resources. Consequently, the generated bytecode responsible for handling query parameters (filtering and sorting) neglects the security metadata associated with the getter-annotated field. This creates a disparity between the actual data projection (where the field may be masked) and the query engine (where the field remains active for logical comparisons).\nAn attack flow involves the following steps: 1. The attacker identifies an exposed REST resource linked to a Panache entity. 2. The attacker observes that a specific field is masked in standard GET responses but realizes that the API permits filtering via query parameters. 3. The attacker crafts a request using 'filter' or 'sort' parameters that reference the secure field. 4. Due to the failure to apply @SecureField, the underlying database query engine processes the requested field as if no security constraint existed. 5. The attacker observes side-channel metadata; for example, if sorting by a 'salary' field, the attacker can infer the relative value of the data based on the returned order of objects, or use equality filters to confirm or deny the presence of specific sensitive values in the database.\nThis vulnerability persists because the backend execution path for filtering and sorting is decoupled from the field-level security check during query construction. Because the sorting and filtering logic happens at the persistence layer, the sensitive data is utilized in 'WHERE' or 'ORDER BY' clauses before the final response body projection occurs. As a result, sensitive data is inferred through the observable behavior of the response set, even though the value is never directly rendered in the JSON output."
}