CVE-2026-66422

Apache Tomcat is affected by an Improper Authorization vulnerability caused by security-role-ref definitions being incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This allows Servlet role references to bypass declarative role cons...