Description

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T22:17:04.900Z",
  "pubdate": "2026-08-25T22:17:04.900Z",
  "executiveSummary": "This vulnerability is an improper access control issue categorized as an incorrect authorization flaw within Apache Tomcat.\nThe vulnerability allows an attacker to bypass configured security constraints, effectively gaining unauthorized access to restricted resources.\nThe flaw occurs due to the order in which security constraints are processed, where a constraint defined for a longer path takes precedence over a more restrictive constraint for a shorter, overlapping sub-path.\nAffected products include Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.\nExploitation requires an attacker to identify existing security constraint configurations within web applications. Successful exploitation may lead to unauthorized access to sensitive application data or privileged functions, bypassing the intended security policy enforced by the web container.\nThe risk is critical for environments relying on container-level path-based authorization to protect backend resources.",
  "technicalDetails": "The root cause of this vulnerability lies in the path-matching logic employed by the Apache Tomcat engine when evaluating security constraints defined in web.xml or via annotations. The container evaluates security constraints by mapping the requested URL against defined security roles and constraints.\nIn the vulnerable versions, the order of constraint evaluation leads to a logical failure. If a developer defines a security constraint for a specific, longer path, and another more restrictive constraint for a shorter, parent-level sub-path exists, the container's resolution engine incorrectly prioritizes the longer path's rule set.\nThis creates an exploitation vector where an attacker can craft requests to sub-paths that should be protected by more restrictive, shorter-path constraints. Because the engine resolves the path against the less restrictive (or differently scoped) rule assigned to the longer path, the authorization check is effectively bypassed or ignored for the parent path.\nAttack flow typically involves the following steps: 1) The attacker enumerates the application structure to identify the specific URL paths protected by various security constraints. 2) The attacker identifies a configuration where a wider, restrictive constraint on a base path is superseded by a permissive or differently defined constraint on a deeper, nested path. 3) The attacker submits a specially crafted request targeting the protected resource. 4) The Tomcat engine improperly matches the request to the constraint of the longer path, thereby circumventing the authorization enforcement of the shorter, restricted path. 5) The request is processed by the application despite the absence of valid authorization credentials for the restricted resource.\nThe vulnerability is inherent to the container's request-processing component responsible for security constraint mapping. It affects all deployments where security constraints are structured in a hierarchical manner that overlaps in ways that trigger the precedence error. There are no specific privilege requirements for the attacker other than network access to the target web application, as the flaw resides in the server's authorization logic itself.\nPost-exploitation impact includes the potential for unauthorized data exfiltration, execution of privileged administrative actions, or total compromise of application-specific functions that rely on container-managed security constraints. The vulnerability is triggered during the authorization phase of the request pipeline, before the request reaches the servlet or filter chain, making it highly effective at bypassing security measures."
}