What is CVE-2026-19651?

CVE-2026-19651 is a high-severity vulnerability in IBM Enterprise Build Of Quarkus, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.4/10. Published 2026-09-08.

How severe is CVE-2026-19651?

High severity. CVSS v3 base score is 7.4 out of 10.

Auth bypass in IBM Enterprise Build Of Quarkus

CVE-2026-19651

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Ibm Enterprise Build Of Quarkus

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-19651?: CVE-2026-19651 is a high-severity vulnerability in IBM Enterprise Build Of Quarkus, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.4/10. Published 2026-09-08.
How severe is CVE-2026-19651?: High severity. CVSS v3 base score is 7.4 out of 10.