An authorization bypass vulnerability was identified in the Quarkus management interface. The flaw exists in the path matching logic within the quarkus-vertx-http component. By default, the management root is set to /q without a trailing slash. When a security policy is defined for a relative path (such as secret), the internal path matcher concatenates these directly as /qsecret instead of /q/secret.

Consequently, the security policy protects the non-existent path /qsecret, while the actual management endpoint at /q/secret remains completely unprotected. A local attacker, or an attacker with access to the private management network, can exploit this flaw to access protected management endpoints without authentication or with low privileges. Successful exploitation allows the attacker to view sensitive internal information and modify management configurations.