Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

🗓️ 26 Aug 2026 00:30:52Reported by GitHub Advisory DatabaseType

Security constraint bypass in Apache Tomcat when longer path constraint precedes shorter sub-path.

Reporter	Title	Published	Views	Family All 34
Circl	CVE-2026-65182	26 Aug 202600:42	–	circl
CVE	CVE-2026-65182	25 Aug 202621:43	–	cve
Cvelist	CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint	25 Aug 202621:43	–	cvelist
Debian CVE	CVE-2026-65182	25 Aug 202621:43	–	debiancve
EUVD	EUVD-2026-66124	26 Aug 202600:30	–	euvd
Kaspersky	KLA91234 SB vulnerabilities in Apache Tomcat	18 Aug 202600:00	–	kaspersky
NVD	CVE-2026-65182	25 Aug 202622:17	–	nvd
OSV	BIT-TOMCAT-2026-65182 Apache Tomcat: Bypass longest prefix security constraint	31 Aug 202608:39	–	osv
OSV	DEBIAN-CVE-2026-65182	25 Aug 202622:17	–	osv
OSV	GHSA-GCX9-497G-6CP6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability	26 Aug 202600:30	–	osv

Vulners

Node

org.apache.tomcat tomcatRange7.0.0–7.0.109maven

org.apache.tomcat tomcatRange8.5.0–8.5.100maven

org.apache.tomcat tomcatRange9.0.0-M1–9.0.121maven

org.apache.tomcat tomcatRange10.1.0-M1–10.1.58maven

org.apache.tomcat tomcatRange11.0.0-M1–11.0.25maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-65182
lists	www.lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m
openwall	www.openwall.com/lists/oss-security/2026/08/26/1
github	www.github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5
github	www.github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf
github	www.github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-gcx9-497g-6cp6

02 Sep 2026 22:37Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

EPSS0.0059

SSVC