CVE-2026-65182
Received
Received - Intake
Improper Access Control in Apache Tomcat
Vulnerability report for CVE-2026-65182, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-25
Last updated on: 2026-08-25
Assigner: Apache Software Foundation
Description
Description
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | From 11.0.0-M1 (inc) to 11.0.24 (inc) |
| apache | tomcat | From 10.1.0-M1 (inc) to 10.1.57 (inc) |
| apache | tomcat | From 9.0.0.M1 (inc) to 9.0.120 (inc) |
| apache | tomcat | From 8.5.0 (inc) to 8.5.100 (inc) |
| apache | tomcat | From 7.0.0 (inc) to 7.0.109 (inc) |
| apache | tomcat | 11.0.25 |
| apache | tomcat | 10.1.58 |
| apache | tomcat | 9.0.121 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
