CVE-2026-66422

Analyzed Analyzed - Analysis Complete

Improper Authorization in Apache Tomcat Due to Role Alias Misuse

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-66422

EUVD

EUVD-2026-66131

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 7.0.97 (inc) to 7.0.109 (inc)
apache	tomcat	From 8.5.46 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Tomcat involves improper authorization due to security-role-ref definitions being incorrectly used as role aliases within the Realm. This means roles defined for authorization checks may not work as intended, potentially allowing unauthorized access to protected resources.

Detection Guidance

This vulnerability involves improper authorization due to incorrect security-role-ref usage in Apache Tomcat. Detection requires checking Tomcat configuration files for misconfigured security-role-ref elements in the Realm section. Review server.xml and web.xml files for role alias definitions that may bypass proper authorization checks.

Impact Analysis

This vulnerability could allow attackers to bypass authorization checks and gain unauthorized access to sensitive data or functions in applications running on affected Tomcat versions. It may lead to data breaches, privilege escalation, or other security incidents depending on the application's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Tomcat versions may face legal penalties, reputational damage, and increased audit scrutiny.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 or later to fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported fixed version immediately.

Hi! I’m here to help you understand CVE-2026-66422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70