Improper Authorization Vulnerability in Apache Tomcat by Apache
CVE-2026-66422

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
25 August 2026

What is CVE-2026-66422?

An improper authorization vulnerability exists in Apache Tomcat due to misconfigurations in security-role-ref definitions. This issue can lead to unauthorized access by enabling role aliases within the Realm, which improperly interacts with the Request.isUserInRole() function. Users are strongly urged to update to Apache Tomcat version 11.0.25, 10.1.58, or 9.0.121 to mitigate this security risk.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.24

Apache Tomcat 10.1.0-M1 <= 10.1.57

Apache Tomcat 9.0.25 <= 9.0.120

References

https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nyg...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

4ra1n, pyn3rd and unam4
.