Improper Authorization in Apache Tomcat causes security constraints defined for the default servlet to be ignored, regardless of the HTTP method specified. This omission enables an attacker to access resources protected by these constraints, effectively bypassing authentication or role checks governed by the servlet’s configuration. The failure aligns with CWE‑285, Unauthorized Access, and can compromise the confidentiality or integrity of any data served through the default servlet.

The issue affects multiple major releases of Apache Tomcat: from 11.0.0‑M1 through 11.0.22, from 10.1.0‑M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Versions that have reached end of support may also be impacted.

The CVSS score is not provided, and EPSS data is unavailable, so the quantified risk is unknown, but the vulnerability enables direct authorization bypass. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, as an external user can send HTTP requests to the affected servlet to trigger the constraint bypass. The lack of EPSS data does not preclude exploitation; the nature of the flaw suggests a plausible exploitation path for anyone who can send traffic to the application.