This flaw stems from an always‑incorrect control flow in Apache Tomcat that causes the logged effective web.xml to omit special roles and empty authorization constraints. The missing data can reveal sensitive configuration details about web application access controls, potentially allowing an attacker who obtains the logs to gain insight into application security posture.

Apache Software Foundation:Apache Tomcat versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22 are impacted. Unsupported or end‑of‑support releases may also be vulnerable.

The EPSS score is not available and the vulnerability is not listed in KEV. Without a publication of a CVSS score, the severity is unclear, but the nature of the issue suggests a moderate risk. Exploitation would likely require the attacker to read the Tomcat logs, which might be restricted to the operating‑system user running the server or to privileged users. If logs are exfiltrated or read locally, the attacker could learn unauthorized configuration details.