Apache Tomcat versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22 contain an improper authorization vulnerability. This flaw causes security constraints for the default servlet to ignore method or method omission configurations, potentially allowing unauthorized access. Fixed versions are 11.0.23, 10.1.56, and 9.0.119. The vulnerability has a CVSS score of 6.5 (medium severity).