Authorization Bypass Vulnerability in Apache Tomcat
CVE-2026-68525

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
25 August 2026

What is CVE-2026-68525?

An incorrect authorization vulnerability in the FORM authentication process of Apache Tomcat allows users to bypass security constraints. This vulnerability enables attackers to access resources restricted for POST but not for GET requests, potentially exposing sensitive information. Affected versions include several releases from 11.0.0-M1 to 9.0.120, with outdated versions 8.5.0 to 8.5.100 and 7.0.0 to 7.0.109 also at risk. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.24

Apache Tomcat 10.1.0-M1 <= 10.1.57

Apache Tomcat 9.0.0.M1 <= 9.0.120

References

https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvg...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

4ra1n, pyn3rd and unam4
.