Skip to main content

Apache Tomcat EUVDEUVD-2026-66131

| CVE-2026-66422 HIGH
Improper Authorization (CWE-285)
2026-08-25 security@apache.org GHSA-w3xg-786f-g788
Authentication Bypass Apache Red Hat Tomcat Suse
8.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
8.1 LOW
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
8.8 HIGH

Role escalation via alias grants read/write access to protected resources, raising C to H over the official C:N; PR:L confirmed by authentication requirement; AV:N per Tomcat's network-facing deployment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
2.7 LOW
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 26, 2026 - 22:37 vuln.today
CVSS changed
Aug 26, 2026 - 20:23 NVD
8.1 (HIGH)
CVE Published
Aug 25, 2026 - 22:17 cve.org
HIGH 8.1
CVE Published
Aug 25, 2026 - 22:17 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

AnalysisAI

Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated user (PR:L) with any role that appears as the source of a security-role-ref mapping in the deployed application's web.xml or annotation configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) characterizes this as network-exploitable by any authenticated user with no interaction required, and the assigned confidentiality impact of N warrants scrutiny: if role escalation allows access to protected resource endpoints, confidential data exposure is plausible and may be underweighted. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, which are the vendor-confirmed fixed releases per the Apache security announcement. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Tomcat deployments running versions 9.0.25-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24, 7.0.97-7.0.109, or 8.5.46-8.5.100; document internet-facing and sensitive-data deployments; restrict authentication to trusted networks and disable unnecessary user accounts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-55166 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-66131 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy