Executive brief
Apache Tomcat's FORM authentication mechanism contains a flaw that allows attackers to bypass access controls on protected resources. An attacker can access resources that should only be available via POST requests by using GET requests instead, potentially exposing sensitive data or allowing unauthorized modifications. This affects a core security component relied upon by organizations worldwide to protect their web applications.
Technical details
This vulnerability is classified as CWE-863 (Incorrect Authorization) in Apache Tomcat's FORM authentication handler. The vulnerability occurs in the authentication process where security constraints that limit access to a resource for POST requests but not GET are incorrectly evaluated. An unauthenticated network attacker can exploit this with no special privileges or user interaction required, by sending GET requests to protected POST-only resources. The flaw allows attackers to read protected data (confidentiality impact) and potentially modify resources (integrity impact). Patches are available in versions 11.0.25, 10.1.58, 9.0.121, and later; versions 7.x and 8.5.x reached end-of-life before fixes were released.
Affected products
- Apache Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24
- Apache tomcat-catalina 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24
- Apache tomcat-embed-core 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24
Timeline
- 2026-08-26: disclosed: Vulnerability disclosed via GitHub Advisory Database
- 2026-08-26: patched: Patches released for versions 11.0.25, 10.1.58, and 9.0.121