CVE-2026-66422
published 2026-08-25CVE-2026-66422: Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in…
PriorityP351high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
0.43%
36.3th percentile
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.58 | 10.1.58 |
| apache | tomcat | >= 11.0.0 < 11.0.25 | 11.0.25 |
| apache | tomcat | 7.0.97 – 7.0.109 | — |
| apache | tomcat | >= 8.5.46 < 9.0.121 | 9.0.121 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.57 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.24 | — |
| apache_software_foundation | apache_tomcat | 7.0.97 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.46 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.25 – 9.0.120 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Tomcat up to 11.0.24 Request.isUserInRole improper authorization (EUVD-2026-66131 / Nessus ID 345835)
vuldb·2026-09-15·CVSS 8.1
CVE-2026-66422 [HIGH] Apache Tomcat up to 11.0.24 Request.isUserInRole improper authorization (EUVD-2026-66131 / Nessus ID 345835)
A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24. It has been classified as critical. This vulnerability affects the function Request.isUserInRole. This manipulation causes improper authorization.
This vulnerability is registered as CVE-2026-66422. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
GHSA
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isU
ghsa_unreviewed·2026-08-26
CVE-2026-66422 CWE-285 Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isU
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Red Hat
tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints
vendor_redhat·2026-08-25·CVSS 8.1
CVE-2026-66422 [HIGH] CWE-386 tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints
tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
A flaw was found in Apache Tomcat. This improper authorization vulnerab
No detection rules found.
No public exploits indexed.
2026-08-25
Published