The vulnerability originates from Apache Tomcat's handling of security-role-ref elements, which are incorrectly treated as role aliases in the Realm. This misinterpretation allows a user who has a role that is referenced by security-role-ref to be considered as having that role, thereby bypassing declarative role constraints that are intended to restrict access. The outcome of this bug is a privilege escalation within applications running on Tomcat, enabling unauthorized actions and potentially exposing protected resources.

All supported Apache Tomcat releases from 11.0.0‑M1 through 11.0.24, 10.1.0‑M1 through 10.1.57, and 9.0.25 through 9.0.120 are affected. Versions already marked End‑of‑Life, including 8.5.46 through 8.5.100 and 7.0.97 through 7.0.109, are also vulnerable, and other unsupported releases may be impacted as well. The affected vendor is the Apache Software Foundation and the product is Apache Tomcat.

The CVSS score is 8.1, and the EPSS score is <1%, indicating a high severity but a low probability of exploitation in the current threat landscape. However, the vulnerability is listed as not part of the CISA KEV catalog, suggesting no known widespread exploitation in the public domain. The flaw requires that an attacker be able to influence the role mapping or deploy code that references security-role-ref elements, implying that the attack vector is likely an application‑level or local privilege scenario. Because a correct attacker can elevate privileges within the Tomcat container, the risk is significant for any application that relies on declarative role constraints for sensitive functionality.