CVE-2026-65182

Published: Aug 25, 2026Modified: Aug 27, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Affected (4)

Products: Apache: Tomcat

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.1.0 to 10.1.58
Apache Tomcat	From 11.0.0 to 11.0.25
Apache Tomcat	From 7.0.0 to 7.0.109
Apache Tomcat	From 8.5.0 to 9.0.121

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m

Source: security@apache.org

Vendor AdvisoryMailing List

http://www.openwall.com/lists/oss-security/2026/08/26/1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryMailing List

Timeline

No history available yet.