CVE-2026-66422

HighCVSS 8.1/10Last modified Aug 27, 2026

Description

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2026
Last modified
Aug 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-664249.8Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.CVE-2026-664256.5Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1CVE-2026-664267.1Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-664277.6Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-664284.3Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-664297.1Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66439.9A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and CVE-2026-664308.5Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-664317.5Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-664327.5Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.CVE-2026-664336.5Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.CVE-2026-664346.5Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.