Improper Access Control Vulnerability in Apache Tomcat
CVE-2026-65182

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
25 August 2026

What is CVE-2026-65182?

An improper access control issue in Apache Tomcat allows for potential security constraint bypass. When a longer path constraint is defined before a more restrictive constraint for a shorter sub-path, it can lead to unauthorized access, compromising the security of the application. It is crucial for users to upgrade to the latest versions, as earlier versions remain vulnerable.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.24

Apache Tomcat 10.1.0-M1 <= 10.1.57

Apache Tomcat 9.0.0.M1 <= 9.0.120

References

https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

4ra1n, pyn3rd and unam4
.