CVE-2026-55956

The record

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-285
• CVE-2026-95860 node-opcua is an OPC UA implementation for TypeScript and Node.js. CWE-285
• CVE-2026-108047 Inadequate authorization vulnerability in Alosuite’s user invitation functionality. CWE-285
• CVE-2025-11969 The System REST APIs do not correctly enforce access control mechanisms, allowing users… CWE-285
• CVE-2026-120319 A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. CWE-285
• CVE-2026-120224 A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. CWE-285
• CVE-2026-77152 Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a… CWE-285
• CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-285