Vulnerability Description
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 7.0.0, <= 7.0.109 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767mVendor AdvisoryMailing List
- http://www.openwall.com/lists/oss-security/2026/08/26/1Third Party AdvisoryMailing List
FAQ
What is CVE-2026-65182?
CVE-2026-65182 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint ...
How severe is CVE-2026-65182?
CVE-2026-65182 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-65182?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.