CVE-2026-55956

Received Received - Intake

Improper Authorization in Apache Tomcat

Publication date: 2026-06-29

Last updated on: 2026-06-29

Assigner: Apache Software Foundation

Description

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-06-29

Generated

2026-06-30

AI Q&A

2026-06-30

EPSS Evaluated

N/A

NVD

CVE-2026-55956

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 11.0.0-M1 (inc) to 11.0.22 (inc)
apache	tomcat	From 10.1.0-M1 (inc) to 10.1.55 (inc)
apache	tomcat	From 9.0.0.M1 (inc) to 9.0.118 (inc)
apache	tomcat	From 8.5.0 (inc) to 8.5.100 (inc)
apache	tomcat	From 7.0.0 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Authorization issue in Apache Tomcat. It causes the security constraints set for the default servlet to ignore any HTTP method or method omission that is configured as part of the constraint.

In other words, the security rules that are supposed to restrict access based on HTTP methods (like GET, POST, etc.) may not be enforced correctly, potentially allowing unauthorized access.

Impact Analysis

Because the security constraints for the default servlet ignore method restrictions, unauthorized users might be able to perform actions or access resources that should be restricted.

This can lead to unauthorized access to sensitive data or functionality, potentially compromising the security of applications running on affected Apache Tomcat versions.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to version 11.0.23, 10.1.56, or 9.0.119, which fix the issue.

Hi! I’m here to help you understand CVE-2026-55956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70