---
id: CVE-2026-55956
aliases:
  - GHSA-5v3h-fjv2-54fg
title: Apache Tomcat has an Improper Authorization vulnerability
summary: Apache Tomcat has an Improper Authorization vulnerability
severity: medium
cvss: 6.5
cwe:
  - CWE-285
vendor: apache
product: 'org.apache.tomcat.embed:tomcat-embed-core'
ecosystem: maven
affected:
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.23'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.56'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.119'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100'
  - 'org.apache.tomcat.embed:tomcat-embed-core <= 7.0.109'
  - 'org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.23'
  - 'org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.56'
  - 'org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.119'
  - 'org.apache.tomcat:tomcat >= 8.5.0, <= 8.5.100'
  - 'org.apache.tomcat:tomcat <= 7.0.109'
  - 'org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.23'
  - 'org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.56'
  - 'org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.119'
  - 'org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100'
  - 'org.apache.tomcat:tomcat-catalina <= 7.0.109'
patched:
  - 'org.apache.tomcat.embed:tomcat-embed-core 11.0.23'
  - 'org.apache.tomcat.embed:tomcat-embed-core 10.1.56'
  - 'org.apache.tomcat.embed:tomcat-embed-core 9.0.119'
  - 'org.apache.tomcat:tomcat 11.0.23'
  - 'org.apache.tomcat:tomcat 10.1.56'
  - 'org.apache.tomcat:tomcat 9.0.119'
  - 'org.apache.tomcat:tomcat-catalina 11.0.23'
  - 'org.apache.tomcat:tomcat-catalina 10.1.56'
  - 'org.apache.tomcat:tomcat-catalina 9.0.119'
published: '2026-06-29'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T16:19:56Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5v3h-fjv2-54fg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55956'
  - url: 'https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/29/25'
  - url: >-
      https://github.com/apache/tomcat/commit/3f6bd2ba5e53d1f340bbe5ad2d42a28b29440b7a
  - url: >-
      https://github.com/apache/tomcat/commit/9c3b1efb74fd04f77639720af1d48a8f664ad9bb
  - url: >-
      https://github.com/apache/tomcat/commit/a0374c450970760efafbd8806a1db278830ba7bd
  - url: 'https://tomcat.apache.org/security-10.html'
  - url: 'https://tomcat.apache.org/security-11.html'
  - url: 'https://tomcat.apache.org/security-9.html'
  - url: 'https://github.com/advisories/GHSA-5v3h-fjv2-54fg'
tags:
  - ghsa
  - maven
epss: 0.00695
epssPercentile: 0.53116
ingestedAt: '2026-11-04T17:19:45.137Z'
---

## Overview

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

## Affected packages

- `org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.23`
- `org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.56`
- `org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0.M1, < 9.0.119`
- `org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, <= 8.5.100`
- `org.apache.tomcat.embed:tomcat-embed-core <= 7.0.109`
- `org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.23`
- `org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.56`
- `org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.119`
- `org.apache.tomcat:tomcat >= 8.5.0, <= 8.5.100`
- `org.apache.tomcat:tomcat <= 7.0.109`
- `org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.23`
- `org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.56`
- `org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.119`
- `org.apache.tomcat:tomcat-catalina >= 8.5.0, <= 8.5.100`
- `org.apache.tomcat:tomcat-catalina <= 7.0.109`

## Remediation

Upgrade to a patched release:

- `org.apache.tomcat.embed:tomcat-embed-core 11.0.23`
- `org.apache.tomcat.embed:tomcat-embed-core 10.1.56`
- `org.apache.tomcat.embed:tomcat-embed-core 9.0.119`
- `org.apache.tomcat:tomcat 11.0.23`
- `org.apache.tomcat:tomcat 10.1.56`
- `org.apache.tomcat:tomcat 9.0.119`
- `org.apache.tomcat:tomcat-catalina 11.0.23`
- `org.apache.tomcat:tomcat-catalina 10.1.56`
- `org.apache.tomcat:tomcat-catalina 9.0.119`