{"id":"CVE-2026-111247","aliases":[],"cve":{"records":[{"id":"CVE-2026-111247","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:36:39.015Z","published":"2026-11-10T15:23:23.893Z","modified":"2026-11-10T15:23:23.893Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:23:23.893Z"}],"references":[{"url":"https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-863","description":"CWE-863 Incorrect Authorization","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Privilege escalation via user name matching a role name","titleSource":"apache","descriptionSource":"apache","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:23:23.893Z","modified":"2026-11-10T15:23:23.893Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"8.0.7","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:tomee-catalina"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111247"}],"remediation":[],"references":["https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3"],"sources":[{"name":"CVE","id":"CVE-2026-111247","modified":"2026-11-10T15:23:23.893Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111247"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:29:58.670Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:35:30.440Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:30:37.640Z","attemptedAt":"2026-11-10T15:30:37.640Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:30:38.698Z","attemptedAt":"2026-11-10T15:30:38.698Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:30:37.543Z","attemptedAt":"2026-11-10T15:30:37.543Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:30:37.552Z","attemptedAt":"2026-11-10T15:30:37.552Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE versions before 10.3.0 and 11.0.0-M2 are affected by a privilege escalation vulnerability. An authenticated attacker with a user name matching a role name can gain that role's privileges. The issue is due to incorrect authorization.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:31:10.409Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111247"}]}}