CVE-2026-68525

An incorrect authorization check in Tomcat’s FORM authentication can allow an authenticated user to bypass a security constraint that restricts access to a resource by HTTP method, enabling a GET request where only POST was permitted. This flaw can expose protected data or trigger unintended actions through GET, compromising the intended confidentiality and integrity of the resource. The weakness involves both a missing authorization boundary (CWE‑863) and an improper access control issue (CWE‑551).

This vulnerability affects Apache Tomcat versions 11.0.0‑M1 through 11.0.24, 10.1.0‑M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End‑of‑life releases 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected, and other unsupported releases may be vulnerable.

The flaw permits method‑based authorization bypass when a user is authenticated via FORM; an attacker with valid credentials can request the restricted resource by GET and gain access that should have been denied. The EPSS score is < 1%, indicating a low probability of exploitation in the wild, yet the CVSS score of 9.1 reflects a very high severity. The impact on confidentiality and integrity is significant. Because the vulnerability is a typical missing‑authorization logic error, it is trivial to exploit once the attacker has access to the authenticated session, making it a high‑risk issue for exposed applications that rely on method constraints.