AIKIDO-2026-189764
tomcat-embed-core is vulnerable to Improper Authorization
59
Medium Risk
This Affects:
tomcat-embed-coreTL;DR
tomcat-embed-core treats security-role-ref entries as Realm role aliases as well as the intended Request.isUserInRole() mapping. A user who holds only the referenced role name can satisfy a declarative role constraint they should not pass. That weakens web.xml role checks that rely on those references. The fix stops the Realm from using security-role-ref as an alias.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the application defines security-role-ref aliases.
Background info
tomcat-embed-core is vulnerable to Improper Authorization in versions 7.0.97 - 9.0.120, 10.1.0 - 10.1.57 and 11.0.0 - 11.0.24.
How to fix this
Upgrade the org.apache.tomcat.embed:tomcat-embed-core library to the patch version.
Links
tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.25lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73openwall.com/lists/oss-security/2026/08/26/6
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.