CVE-2026-43515 is an improper authorization vulnerability in Apache Tomcat that occurs when multiple method constraints define the same HTTP method for the same extension, leading to incorrect enforcement of security constraints. This can allow remote attackers to bypass authorization restrictions. The vulnerability affects Apache Tomcat versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0 through 9.0.117, 10.1.0 through 10.1.54, and 11.0.0 through 11.0.21. Ubuntu security advisories USN-8383-1 and USN-8417-1 confirm the issue and provide fixed package versions. The vulnerability is rated critical due to its potential to bypass authorization controls.

A remote attacker could exploit this vulnerability to bypass authorization restrictions in Apache Tomcat, potentially gaining unauthorized access to protected resources. This undermines the security model of applications relying on Tomcat's method constraint enforcement. The vulnerability affects multiple major Tomcat versions and could impact a wide range of deployments until patched.

A fix is available. Users are strongly advised to upgrade Apache Tomcat to versions 11.0.22, 10.1.55, or 9.0.118 or later. Ubuntu users should apply the security updates provided in the Ubuntu security notices USN-8383-1 and USN-8417-1 and restart Tomcat after updating to ensure the fix is applied. No additional mitigations are specified beyond applying the official patches.