CVE-2026-55956Medium· 6.5▾ SunlitApache Tomcat has an Improper Authorization vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.7%
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.23org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.56org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.119org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100org.apache.tomcat.embed:tomcat-embed-core <= 7.0.109org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.23org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.56org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.119org.apache.tomcat:tomcat >= 8.5.0, <= 8.5.100org.apache.tomcat:tomcat <= 7.0.109org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.23org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.56org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.119org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100org.apache.tomcat:tomcat-catalina <= 7.0.109Upgrade to a patched release:
org.apache.tomcat.embed:tomcat-embed-core 11.0.23org.apache.tomcat.embed:tomcat-embed-core 10.1.56org.apache.tomcat.embed:tomcat-embed-core 9.0.119org.apache.tomcat:tomcat 11.0.23org.apache.tomcat:tomcat 10.1.56org.apache.tomcat:tomcat 9.0.119org.apache.tomcat:tomcat-catalina 11.0.23org.apache.tomcat:tomcat-catalina 10.1.56org.apache.tomcat:tomcat-catalina 9.0.119Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55957High· 7.3Apache Tomcat has a Missing Critical Step in Authentication vulnerability
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group
CVE-2023-5675Medium· 6.5Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
CVE-2023-21474Medium· 6.3Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
CVE-2025-11969Critical· 9.4Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CVE-2025-12720Medium· 5.3The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1