Apache Tomcat 8-11.0.24 Improper Auth via Role Alias (CVE-2026-66422)
CVE-2026-66422 Published on August 25, 2026
Apache Tomcat: Servlet role references can bypass declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-66422 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-66422
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M1, <= 11.0.24 is affected.
- Version 10.1.0-M1, <= 10.1.57 is affected.
- Version 9.0.25, <= 9.0.120 is affected.
- Version 8.5.46, <= 8.5.100 is affected.
- Version 7.0.97, <= 7.0.109 is affected.
- Before 7.0.97 is unaffected.