CVE-2026-55956 is an improper authorization vulnerability (CWE-285) in Apache Tomcat where security constraints specified for the default servlet do not correctly enforce restrictions based on HTTP methods or their omission. This results in the constraints being ignored, potentially allowing unauthorized access to resources. The affected versions include Apache Tomcat from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22. The issue is resolved in versions 11.0.23, 10.1.56, and 9.0.119.

The vulnerability allows security constraints on the default servlet to be bypassed due to improper enforcement of HTTP method restrictions. This can lead to unauthorized access to resources that should be protected, impacting confidentiality and integrity with no impact on availability. The CVSS score of 6.5 reflects a medium severity risk with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Users should upgrade affected Apache Tomcat installations to versions 11.0.23, 10.1.56, or 9.0.119 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the provided data. Patch status is confirmed by the vendor advisory information in the description.