Improper Authorization in Apache Tomcat causes security constraints defined for the default servlet to be ignored, regardless of the HTTP method specified. This omission enables an attacker to access resources protected by these constraints, effectively bypassing authentication or role checks governed by the servlet’s configuration. The failure aligns with CWE‑285, Unauthorized Access, as well as CWE‑551, indicating issues in configuration handling that can lead to improper access control. It can compromise the confidentiality or integrity of any data served through the default servlet.

The vulnerability affects Apache Tomcat across several major release streams. Versions from 11.0.0‑M1 through 11.0.22, from 10.1.0‑M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109 are susceptible. In addition, any older releases that have reached end‑of‑support may also be impacted. The flaw is fixed in Tomcat 11.0.23, 10.1.56, 9.0.119 and newer.

The CVSS score of 6.5 indicates a medium severity vulnerability, and with an EPSS score of < 1% the probability of exploitation appears low. Nevertheless, the flaw still enables direct authorization bypass and remains not listed in the CISA KEV catalog. An external user can send HTTP requests to the affected servlet to trigger the constraint bypass, though this attack vector is inferred rather than directly stated. Although the EPSS score is low, the nature of the flaw suggests a plausible exploitation path for anyone who can send traffic to the application.