Description

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T22:17:05.560Z",
  "pubdate": "2026-08-25T22:17:05.560Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within Apache Tomcat, where security-role-ref definitions are erroneously treated as role aliases within the Realm.\nThe issue affects Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.25 through 9.0.120.\nLegacy and EOL versions, including 8.5.46 through 8.5.100 and 7.0.97 through 7.0.109, are also confirmed as vulnerable.\nThe flaw stems from a misinterpretation of role-mapping logic, allowing unauthorized users to potentially bypass or escalate access controls that rely on Realm-level role validation.\nAn attacker capable of manipulating or influencing security-role-ref mappings could potentially gain elevated privileges or access resources that should be restricted based on defined security constraints.\nThe risk is significant as it undermines the integrity of the authorization layer, leading to potential unauthorized access to protected web application resources.",
  "technicalDetails": "The vulnerability originates from a flawed implementation in how Apache Tomcat handles 'security-role-ref' elements defined in web.xml files. While 'security-role-ref' is intended to map a security role name used within a specific servlet to a role name defined in the global security configuration (using the Request.isUserInRole() method), the Realm implementation incorrectly treats these definitions as global role aliases.\nIn a secure configuration, 'security-role-ref' should be scoped to the internal logic of the servlet. However, the current defect causes the Realm to inadvertently honor these local role definitions as valid security roles across the broader application context. This results in a scenario where a role defined only for internal servlet reference is mistakenly recognized by the Realm as a valid, globally assigned role for the authenticated user.\nThe attack flow involves an adversary leveraging the incorrect role resolution during the authentication and authorization lifecycle. If a user is assigned a specific role, and a servlet defines a 'security-role-ref' that maps an internal reference to a more privileged role name, the Tomcat Realm may permit access to protected resources that are explicitly restricted to that privileged role, even if the user does not possess that role globally.\nBecause the Realm is responsible for validating if a principal possesses the required roles to access a given URL pattern or resource, the leakage of the 'security-role-ref' into the Realm's decision-making process allows a principal to appear as having a broader set of permissions than intended.\nExploitation requires the attacker to identify or influence the deployment of an application that utilizes 'security-role-ref' mappings that overlap or interact with sensitive application roles. Once the target application is identified, an attacker with valid, low-privileged access can potentially access higher-privileged functionality by manipulating the authorization check via the misidentified role.\nThe vulnerable component is the Realm architecture within Apache Tomcat, specifically the logic responsible for role resolution and principal evaluation. This behavior persists across multiple versions of the Tomcat container, suggesting a deep-seated issue in the integration between the deployment descriptor parsing (security-role-ref) and the Realm's security check mechanism."
}