Critical Apache Tomcat Flaw Enables Unauthenticated Access-Control Bypass
Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 3, 2026
Apache Tomcat has remediated CVE-2026-65182, a critical improper authorization and access-control flaw (CVSS 9.1) that can let an unauthenticated remote attacker bypass configured security constraints. The issue arises when a constraint for a longer URL path is declared before a more restrictive constraint for a shorter subpath, causing Tomcat to apply access controls incorrectly. No public exploitation was known at the time of the notices.
Affected releases include Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.120, 10.1.0-M1–10.1.57, and 11.0.0-M1–11.0.24, including deployments using embedded Tomcat libraries. Organizations should identify exposed instances and update to fixed releases—Tomcat 9.0.121, 10.1.58 or later, and 11.0.25 or later—while validating URL security-constraint ordering after remediation.
