CVE-2026-65182
published 2026-08-25CVE-2026-65182: Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is…
PriorityP259critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.54%
44.5th percentile
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.58 | 10.1.58 |
| apache | tomcat | >= 11.0.0 < 11.0.25 | 11.0.25 |
| apache | tomcat | 7.0.0 – 7.0.109 | — |
| apache | tomcat | >= 8.5.0 < 9.0.121 | 9.0.121 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.57 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.24 | — |
| apache_software_foundation | apache_tomcat | 7.0.0 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.120 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
vendor_redhat·2026-08-25·CVSS 9.1
CVE-2026-65182 [CRITICAL] CWE-551 Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longe
VulDB
Apache Tomcat up to 11.0.24 access control (Nessus ID 344996)
vuldb·2026-09-12·CVSS 9.1
CVE-2026-65182 [CRITICAL] Apache Tomcat up to 11.0.24 access control (Nessus ID 344996)
A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 and classified as critical. Affected is an unknown function. Executing a manipulation can lead to improper access controls.
This vulnerability is registered as CVE-2026-65182. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
ghsa·2026-08-26
CVE-2026-65182 [CRITICAL] CWE-284 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
GHSA
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint
ghsa_unreviewed·2026-08-26
CVE-2026-65182 CWE-284 Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65182 tomcat: Apache Tomcat: Security constraint bypass due to improper access control [fedora-all]
bugzilla·2026-09-07·CVSS 9.1
CVE-2026-65182 [CRITICAL] CVE-2026-65182 tomcat: Apache Tomcat: Security constraint bypass due to improper access control [fedora-all]
CVE-2026-65182 tomcat: Apache Tomcat: Security constraint bypass due to improper access control [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25,
Bugzilla
CVE-2026-65182 Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
bugzilla·2026-08-25·CVSS 9.1
CVE-2026-65182 [CRITICAL] CVE-2026-65182 Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65182 Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
2026-08-25
Published