CVE-2026-68525

Analyzed Analyzed - Analysis Complete

Incorrect Authorization Bypass in Apache Tomcat FORM Authentication

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-68525

EUVD

EUVD-2026-66132

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 7.0.0 (inc) to 7.0.109 (inc)
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Tomcat's FORM authentication allows attackers to bypass security constraints by exploiting incorrect authorization. Specifically, it enables access to resources via POST requests even when only GET requests are permitted.

Detection Guidance

This vulnerability involves bypassing security constraints in Apache Tomcat's FORM authentication. Detection requires checking Tomcat versions and reviewing authentication logs for unauthorized access attempts. Upgrade to fixed versions (11.0.25, 10.1.58, or 9.0.121) to resolve the issue.

Impact Analysis

An attacker could gain unauthorized access to protected resources by sending POST requests, potentially leading to data breaches, privilege escalation, or other malicious activities depending on the application's functionality.

Compliance Impact

This vulnerability allows unauthorized access to resources by bypassing security constraints, which could lead to exposure of sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to personal or protected health information.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 to fix the vulnerability.

Hi! I’m here to help you understand CVE-2026-68525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70