criticalCVSS 9.1Vulnerability
CVE-2026-65182
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Properties
- ghsa_id
- GHSA-gcx9-497g-6cp6
- severity
- critical
- summary
- Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
- cvss_score
- 9.1
- cve_id
- CVE-2026-65182
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- is_ghsa_only
- false
- ghsa_published
- 2026-08-26T00:30:52Z
- source_url
- https://github.com/advisories/GHSA-gcx9-497g-6cp6
- ghsa_updated
- 2026-09-02T22:37:45Z
Related Entities (8)
HAS_WEAKNESS (1)
→[Weakness]Improper Access Control
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (3)
←[Software]maven/org.apache.tomcat:tomcat
←[Software]maven/org.apache.tomcat.embed:tomcat-embed-core
←[Software]maven/org.apache.tomcat:tomcat-catalina
AFFECTS (3)
→[Software]maven/org.apache.tomcat:tomcat
→[Software]maven/org.apache.tomcat:tomcat-catalina
→[Software]maven/org.apache.tomcat.embed:tomcat-embed-core
Explore deeper with Ninja Signal's threat intelligence graph