{"id":"CVE-2026-111245","aliases":[],"cve":{"records":[{"id":"CVE-2026-111245","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:36:38.336Z","published":"2026-11-10T15:24:08.081Z","modified":"2026-11-10T15:24:08.081Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:24:08.081Z"}],"references":[{"url":"https://lists.apache.org/thread/6nr7gp3kxf919mhv2o0yg45t310x5go8","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-488","description":"CWE-488 Exposure of Data Element to Wrong Session","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests","titleSource":"apache","descriptionSource":"apache","description":"After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:24:08.081Z","modified":"2026-11-10T15:24:08.081Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.0.0-beta-1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-cxf","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-cxf"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111245"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-cxf","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-cxf"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111245"}],"remediation":[],"references":["https://lists.apache.org/thread/6nr7gp3kxf919mhv2o0yg45t310x5go8"],"sources":[{"name":"CVE","id":"CVE-2026-111245","modified":"2026-11-10T15:24:08.081Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111245"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:29:56.030Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:35:31.150Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:30:34.739Z","attemptedAt":"2026-11-10T15:30:34.739Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:30:35.063Z","attemptedAt":"2026-11-10T15:30:35.063Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:30:34.717Z","attemptedAt":"2026-11-10T15:30:34.717Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:30:34.415Z","attemptedAt":"2026-11-10T15:30:34.415Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE versions 4.0.0-beta-1 to 4.7.5, 7.0.0-M1 to 10.0.0-M1, and 10.0.0-M1 to 10.3.0, and 11.0.0-M1 to 11.0.0-M2 are affected by a privilege escalation vulnerability. A remote unauthenticated attacker can invoke protected EJB methods with a previously authenticated user's identity. The issue is fixed in versions 10.3.0 and 11.0.0-M2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:31:06.320Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111245"}]}}