CVE-2026-66422: CWE-285 Improper Authorization in Apache Software Foundation Apache Tomcat
Description
CVE-2026-66422 is an improper authorization vulnerability in Apache Tomcat caused by incorrect usage of security-role-ref definitions as role aliases within the Realm. This affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.25 through 9.0.120, as well as some end-of-life versions. The issue is fixed in versions 11.0.25, 10.1.58, and 9.0.121.
CVSS v3.1
Score 8.1high
Affected software
Apache Software Foundation
Apache Tomcat
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from Apache Tomcat incorrectly using security-role-ref definitions as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This improper authorization flaw could allow unauthorized privilege escalation or access control bypass. Affected versions span multiple major release lines, including some end-of-life versions. The Apache Software Foundation has addressed the issue in versions 11.0.25, 10.1.58, and 9.0.121.
Potential Impact
The vulnerability allows improper authorization, potentially enabling attackers with limited privileges to escalate their privileges or bypass access controls within affected Apache Tomcat servers. The CVSS score of 8.1 indicates a high severity impact with no confidentiality impact but high integrity and availability impacts.
Mitigation Recommendations
Users should upgrade affected Apache Tomcat instances to versions 11.0.25, 10.1.58, or 9.0.121 or later, where the issue is fixed. There is no indication of temporary mitigations or that the issue is already mitigated without upgrading. Patch status is confirmed by the vendor advisory recommending these fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-27T07:51:40.260Z
- State
- PUBLISHED
Threat ID: 6a8e123aacd9273b49c46801
Added to database: 08/25/2026, 22:07:54 UTC
Last enriched: 09/08/2026, 13:12:18 UTC
Last updated: 10/09/2026, 18:48:22 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.