Threats affecting pkg:maven/org.apache.tomee/tomee-catalina

CVE-2026-111247 is an incorrect authorization vulnerability in Apache TomEE where a user's name is incorrectly treated as a role name during authorization checks. An attacker who can register an account with a username matching a role name can gain unauthorized access to that role's permissions. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

Apache TomEE versions from 1.5.1 through 1.7.5, 7.0.0-M1 through before 10.0.0-M1, 10.0.0-M1 through before 10.3.0, and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where the default configuration silently adds an administrative user with a well-known password if no users are defined. This allows remote attackers to authenticate using these default credentials and gain administrative access. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE contains an incorrect authorization vulnerability in its optional request routing feature. This flaw allows requests to be forwarded to their configured destinations without enforcing the security constraints or protections of the target web application's private directories. If the routing configuration copies client-controlled parts of the request path, a remote attacker may access protected resources or read sensitive application configuration and class files. The issue affects specific versions of Apache TomEE and is fixed in versions 10.3.0 and 11.0.0-M2.