Vulnerability GHSA-gcx9-497g-6cp6
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
2 months ago
August 26, 2026 at 12:30 AM UTC
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24
Summary
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Details
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
9.0.115 - 9.0.120 and 10.1.53 - 10.1.57 and 11.0.20 - 11.0.24 GHSA-f525-44xv-f2qj
9.0.115 - 9.0.120 and 10.1.53 - 10.1.57 and 11.0.20 - 11.0.24 GHSA-f525-44xv-f2qj
Critical
2 months ago
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-h3x4-894j-xpx5
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-h3x4-894j-xpx5
Impacted packages
Timeline
Published
2 months ago
August 26, 2026 at 12:30 AM UTC
Fixed (11.0.25)
Unknown
Unknown
Fixed (9.0.121)
Unknown
Unknown
Fixed (11.0.25)
Unknown
Unknown
Fixed (9.0.121)
Unknown
Unknown
Fixed (11.0.25)
Unknown
Unknown
Fixed (9.0.121)
Unknown
Unknown
Last Modified
1 month ago
September 11, 2026 at 08:25 AM UTC