CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potentially leading to unauthorized access to resources.

This Important vulnerability in Apache Tomcat allows for security constraint bypasses, potentially granting unauthorized access to protected web application resources. The flaw occurs when security constraints for longer URL paths are defined before more restrictive constraints for shorter, specific sub-paths within the application's web.xml configuration. This misconfiguration can undermine intended access controls in Red Hat deployments of Apache Tomcat.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that security constraints in Apache Tomcat's web.xml configuration files are ordered from most specific to least specific. More restrictive constraints for shorter sub-paths must be defined before broader constraints for longer paths. Incorrect ordering can lead to a bypass of intended access controls. After modifying web.xml, a restart or reload of the Apache Tomcat service is required for the changes to take effect, which may temporarily interrupt service availability.