CVE-2026-68525: Apache Tomcat FORM Authentication Incorrect Authorization Vulnerability

org.apache.tomcat:tomcat Updated 03 Sep 2026

Summary

26/08/2026

Disclosed on

CVE-2026-68525

CVE

Yes i

Fix available

Critical

Severity

9.1

CVSS Score

CVE-2026-68525: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability. Affects org.apache.tomcat:tomcat across 5 version ranges.

>= 7.0.0, <= 7.0.109 >= 8.5.0, <= 8.5.100 >= 9.0.0-M1, < 9.0.121 >= 10.1.0-M1, < 10.1.58 >= 11.0.0-M1, < 11.0.25

Fixed in 9.0.121, 10.1.58 or 11.0.25, depending on the release line you run. How to fix ↓

Also tracked for

tomcat · Bitnami

The same CVE-2026-68525 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java web applications. The software provides a robust environment for running web applications, offering features such as security, scalability, and performance. However, certain versions of Tomcat are vulnerable to an Incorrect Authorization issue in its FORM authentication process, which can lead to unauthorized access to restricted resources.

Vulnerability Detail

The Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows attackers to bypass security constraints that limit user access to resources. Specifically, it enables users to access resources via GET requests even when they are only authorized for POST requests. This flaw can lead to unauthorized data exposure and manipulation, posing significant security risks to applications relying on Tomcat for authentication.

How To Fix

Latest published version: 11.0.27 as of 23 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 9.0.0-M1, < 9.0.121 9.0.121
>= 10.1.0-M1, < 10.1.58 10.1.58
>= 11.0.0-M1, < 11.0.25 11.0.25

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, users can implement additional access control measures at the application level to restrict GET requests to sensitive resources until the upgrade can be performed.

Conclusion

The Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process poses a significant risk to applications using affected versions. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Implementing additional access controls can provide temporary relief until the upgrade is completed.

See every vulnerability recorded for org.apache.tomcat:tomcat →

FAQ

What is the CVSS score of this vulnerability?

The CVSS score of this vulnerability is 9.1, indicating a critical severity level.

Which versions of Apache Tomcat are affected?

Affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0-M1 through 9.0.120. Additionally, versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also known to be affected.

How can I check if my application is affected by this vulnerability?

You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.

What should I do if I cannot upgrade immediately?

If immediate upgrading is not possible, implement additional access control measures to restrict access to sensitive resources until the upgrade can be completed.