Access Control Flaw in MicroProfile JWT for JAX-RS Resources by MicroProfile

CVE-2026-111244

What is CVE-2026-111244?

An access control vulnerability in MicroProfile JWT impacts JAX-RS resources by failing to enforce declared access constraints. When role-based access control is utilized, an empty set of allowed roles enables unrestricted access to all callers. Additionally, resource classes that inherit methods from a common superclass may incorrectly share their access constraints, while constraints declared at the class level in a superclass can be overlooked altogether. This misconfiguration allows remote attackers to invoke restricted resources without proper authentication. Users are urged to upgrade to versions 10.3.0 or 11.0.0-M2 for resolution of these issues.

References