Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

🗓️ 26 Aug 2026 00:30:52Reported by GitHub Advisory DatabaseType

Security constraint bypass in Apache Tomcat when longer path constraint precedes shorter sub-path.

Reporter	Title	Published	Views	Family All 196
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.	9 Sep 202609:46	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	5 Oct 202608:14	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	28 Sep 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)	14 Oct 202606:16	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)	12 Oct 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21811-1)	11 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21823-1)	12 Sep 202600:00	–	nessus

Vulners

Node

org.apache.tomcat.embed tomcat-embed-coreRange7.0.0–7.0.109maven

org.apache.tomcat.embed tomcat-embed-coreRange8.5.0–8.5.100maven

org.apache.tomcat.embed tomcat-embed-coreRange9.0.0-M1–9.0.121maven

org.apache.tomcat.embed tomcat-embed-coreRange10.1.0-M1–10.1.58maven

org.apache.tomcat.embed tomcat-embed-coreRange11.0.0-M1–11.0.25maven

org.apache.tomcat tomcat-catalinaRange7.0.0–7.0.109maven

org.apache.tomcat tomcat-catalinaRange8.5.0–8.5.100maven

org.apache.tomcat tomcat-catalinaRange9.0.0-M1–9.0.121maven

org.apache.tomcat tomcat-catalinaRange10.1.0-M1–10.1.58maven

org.apache.tomcat tomcat-catalinaRange11.0.0-M1–11.0.25maven

org.apache.tomcat tomcatRange7.0.0–7.0.109maven

org.apache.tomcat tomcatRange8.5.0–8.5.100maven

org.apache.tomcat tomcatRange9.0.0-M1–9.0.121maven

org.apache.tomcat tomcatRange10.1.0-M1–10.1.58maven

org.apache.tomcat tomcatRange11.0.0-M1–11.0.25maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-65182
lists	www.lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m
openwall	www.openwall.com/lists/oss-security/2026/08/26/1
github	www.github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5
github	www.github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf
github	www.github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-gcx9-497g-6cp6

02 Sep 2026 22:37Current

8High risk

Vulners AI Score8

CVSS 3.19.1

EPSS0.00538

SSVC

CWE-284