{"id":"CVE-2026-111258","aliases":[],"cve":{"records":[{"id":"CVE-2026-111258","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:59:33.109Z","published":"2026-11-10T15:19:06.357Z","modified":"2026-11-10T15:19:06.357Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:19:06.357Z"}],"references":[{"url":"https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-863","description":"CWE-863 Incorrect Authorization","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Security constraint bypass via request routing","titleSource":"apache","descriptionSource":"apache","description":"The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:19:06.357Z","modified":"2026-11-10T15:19:06.357Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"1.5.0","status":"affected","lessThanOrEqual":"1.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/tomee-catalina","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:tomee-catalina"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111258"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:tomee-catalina"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111258"}],"remediation":[],"references":["https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m"],"sources":[{"name":"CVE","id":"CVE-2026-111258","modified":"2026-11-10T15:19:06.357Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111258"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:30:27.152Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:35:30.440Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-15T03:45:50.652Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-15T03:20:40.467Z","attemptedAt":"2026-11-15T03:20:40.467Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-15T03:20:40.343Z","attemptedAt":"2026-11-15T03:20:40.343Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-15T03:20:37.310Z","attemptedAt":"2026-11-15T03:20:37.310Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-111258","url":"https://www.first.org/epss/","probability":0.00213,"percentile":0.11725,"date":"2026-11-14","checkedAt":"2026-11-15T03:20:37.310Z"},{"source":"ENISA EUVD","id":"EUVD-2026-121223","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121223","modified":"Nov 10, 2026, 3:19:06 PM","checkedAt":"2026-11-15T03:20:40.343Z"},{"source":"GitHub Advisory Database","id":"GHSA-x87m-62hv-8665","url":"https://github.com/advisories/GHSA-x87m-62hv-8665","modified":"2026-11-10T18:31:46Z","checkedAt":"2026-11-15T03:20:40.467Z"}],"aiSummary":{"text":"Apache TomEE versions 1.5.0 to 1.7.5, 7.0.0-M1 to 10.0.0-M1, and 10.0.0-M1 to 10.3.0 and 11.0.0-M1 to 11.0.0-M2 are affected by a security constraint bypass via request routing, allowing a remote attacker to reach protected resources. The issue only affects installations with specific routing configurations.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:36:09.422Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111258"}]}}