NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2026-68525: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

criticalCVSS 3.1 9.1GHSA-h3x4-894j-xpx5

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

Published Aug 26, 2026 · Updated Sep 2, 2026

Affected packages

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 9.0.0-M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem
Maven
Affected
>= 7.0.0, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 9.0.0-M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat:tomcat-catalina

Ecosystem
Maven
Affected
>= 7.0.0, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-catalina

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 11.0.0-M1, < 11.0.25
Fixed in
11.0.25
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 10.1.0-M1, < 10.1.58
Fixed in
10.1.58
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 9.0.0-M1, < 9.0.121
Fixed in
9.0.121
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 8.5.0, <= 8.5.100
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-core

Ecosystem
Maven
Affected
>= 7.0.0, <= 7.0.109
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

Credited to oscerd.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries