CVE-2026-66422

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109

Description An improper authorization issue exists where security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their intended use with Request.isUserInRole().

Recommendations Upgrade versions 11.0.0-M1 through 11.0.24 to 11.0.25. Upgrade versions 10.1.0-M1 through 10.1.57 to 10.1.58. Upgrade versions 9.0.25 through 9.0.120 to 9.0.121.