CVE-2026-65182: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Published Aug 26, 2026 · Updated Sep 2, 2026
Affected packages
org.apache.tomcat:tomcat
- Ecosystem
- Maven
- Affected
- >= 11.0.0-M1, < 11.0.25
- Fixed in
- 11.0.25
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat
org.apache.tomcat:tomcat
- Ecosystem
- Maven
- Affected
- >= 10.1.0-M1, < 10.1.58
- Fixed in
- 10.1.58
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat
org.apache.tomcat:tomcat
- Ecosystem
- Maven
- Affected
- >= 9.0.0-M1, < 9.0.121
- Fixed in
- 9.0.121
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat
org.apache.tomcat:tomcat
- Ecosystem
- Maven
- Affected
- >= 8.5.0, <= 8.5.100
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat
org.apache.tomcat:tomcat
- Ecosystem
- Maven
- Affected
- >= 7.0.0, <= 7.0.109
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat
org.apache.tomcat:tomcat-catalina
- Ecosystem
- Maven
- Affected
- >= 11.0.0-M1, < 11.0.25
- Fixed in
- 11.0.25
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina
org.apache.tomcat:tomcat-catalina
- Ecosystem
- Maven
- Affected
- >= 10.1.0-M1, < 10.1.58
- Fixed in
- 10.1.58
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina
org.apache.tomcat:tomcat-catalina
- Ecosystem
- Maven
- Affected
- >= 9.0.0-M1, < 9.0.121
- Fixed in
- 9.0.121
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina
org.apache.tomcat:tomcat-catalina
- Ecosystem
- Maven
- Affected
- >= 8.5.0, <= 8.5.100
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina
org.apache.tomcat:tomcat-catalina
- Ecosystem
- Maven
- Affected
- >= 7.0.0, <= 7.0.109
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina
org.apache.tomcat.embed:tomcat-embed-core
- Ecosystem
- Maven
- Affected
- >= 11.0.0-M1, < 11.0.25
- Fixed in
- 11.0.25
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat.embed:tomcat-embed-core
- Ecosystem
- Maven
- Affected
- >= 10.1.0-M1, < 10.1.58
- Fixed in
- 10.1.58
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat.embed:tomcat-embed-core
- Ecosystem
- Maven
- Affected
- >= 9.0.0-M1, < 9.0.121
- Fixed in
- 9.0.121
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat.embed:tomcat-embed-core
- Ecosystem
- Maven
- Affected
- >= 8.5.0, <= 8.5.100
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat.embed:tomcat-embed-core
- Ecosystem
- Maven
- Affected
- >= 7.0.0, <= 7.0.109
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Credited to oscerd.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-65182
- https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m
- https://github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5
- https://github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf
- https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- https://github.com/advisories/GHSA-gcx9-497g-6cp6
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Maven vulnerabilities
All Maven entriesCVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
critical9.8No fixAug 26, 2026CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
critical9.1No fixAug 26, 2026CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
critical9.8May 12, 2026CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
critical9.8May 12, 2026CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
critical9.1May 12, 2026CVE-2026-29145
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
critical9.1Apr 9, 2026