Authorization Bypass Vulnerability in Apache Tomcat

CVE-2026-68525

What is CVE-2026-68525?

An incorrect authorization vulnerability in the FORM authentication process of Apache Tomcat allows users to bypass security constraints. This vulnerability enables attackers to access resources restricted for POST but not for GET requests, potentially exposing sensitive information. Affected versions include several releases from 11.0.0-M1 to 9.0.120, with outdated versions 8.5.0 to 8.5.100 and 7.0.0 to 7.0.109 also at risk. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.

References