CVE-2026-68525: CWE-863 Incorrect Authorization in Apache Software Foundation Apache Tomcat

The vulnerability identified as CVE-2026-68525 involves an incorrect authorization flaw (CWE-863) in Apache Tomcat's FORM authentication mechanism. Specifically, it allows an attacker to bypass security constraints that limit user access to HTTP POST requests but not GET requests for certain resources. This could lead to unauthorized access to resources that should be restricted. The affected versions span from early milestone releases through several stable releases across multiple major version branches of Apache Tomcat. The Apache Software Foundation has addressed this issue in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.

The vulnerability allows unauthorized users to bypass security constraints intended to restrict access to certain HTTP methods on protected resources. This can lead to unauthorized disclosure or modification of sensitive information, as indicated by the CVSS score of 9.1 (critical) with high confidentiality and integrity impact but no impact on availability. There are no known exploits in the wild at the time of this report.

Users are strongly advised to upgrade affected Apache Tomcat installations to versions 11.0.25, 10.1.58, or 9.0.121 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor's version upgrade recommendations.