CVE record · 1 source
CVE-2026-111247
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles…
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-863
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles…
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user…