---
id: CVE-2026-121837
title: >-
  Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level
  @securefield ignored for filter and sort
summary: >-
  A flaw was found in the REST Data Panache component of Quarkus. When a
  security constraint is applied to an entity property using the @SecureField
  annotation on its getter method rather than the field itself, the generated
  REST resource …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Red Hat
product: exploit-intelligence/agent-client-rhel9
affected:
  - exploit-intelligence/agent-client-rhel9 (all versions)
  - quarkus-rest-data-panache (all versions)
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T05:39:00.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121837'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-121837'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2566744'
    label: RHBZ#2566744
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.286Z'
---

## Overview

A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.

## Affected

- `exploit-intelligence/agent-client-rhel9 (all versions)`
- `quarkus-rest-data-panache (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.