Threats affecting pkg:maven/org.apache.tomee/tomee-webservices

Apache TomEE versions from 1.5.0 through 4.0.0 and certain milestone releases up to 10.3.0 and 11.0.0-M2 have a missing authentication enforcement issue for EJB JAX-WS endpoints when published within existing web applications. This allows remote unauthenticated attackers to invoke web service operations unless additional application-level security constraints are applied. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

CVE-2026-111264 is an authentication bypass vulnerability in Apache TomEE affecting EJB JAX-WS endpoints. The security constraint for these endpoints only protects certain HTTP methods, allowing a remote unauthenticated attacker to bypass authentication by using an alternate HTTP method. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.