CVE-2026-65182
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Improper access control and incorrect authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. Affects a wide range of versions from 7.0.0 through 11.0.24.
Risk Assessment
An attacker could bypass access controls, gaining access to resources that should be protected, potentially leading to unauthorized access to data or functionality.
Recommendation
It is recommended to upgrade to version 11.0.25, 10.1.58, or 9.0.121, which fix the issue.
Original NVD description (English source)
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.