Role Confusion Vulnerability in Apache Software Products
CVE-2026-111247

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomee
Vendor
CVE Published:
10 November 2026

What is CVE-2026-111247?

The vulnerability arises when the security roles assigned to a realm-authenticated user are improperly evaluated, allowing an authenticated attacker to exploit a situation where the user's name coincidentally matches the name of a role. This misconfiguration can grant unauthorized permissions to the attacker wherever access control is enforced through the Jakarta Authorization policy. It is crucial for users to upgrade to versions 10.3.0 or 11.0.0-M2 to mitigate this issue effectively.

Affected Version(s)

Apache TomEE 8.0.7 < 10.0.0-M1

Apache TomEE 10.0.0-M1 < 10.3.0

Apache TomEE 11.0.0-M1 < 11.0.0-M2

References

https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2g...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Claude Security
Richard Zowalla
.