{"id":"CVE-2026-111247","aliases":["EUVD-2026-121243","GHSA-hp35-79g6-r3v6"],"status":"published","title":"Apache TomEE: Privilege escalation via user name matching a role name","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","epss":{"day":"2026-11-12","score":0.00132,"percentile":0.02855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-11-10T15:23:23Z","modified":"2026-11-10T18:31:38Z","products":[{"vendor":"apache software foundation","product":"apache tomee"}],"references":[{"url":"https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111247"},{"url":"https://github.com/advisories/GHSA-hp35-79g6-r3v6"}],"sources":{"cve":[{"id":"CVE-2026-111247","title":"Apache TomEE: Privilege escalation via user name matching a role name","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:23:23.893Z","modified":"2026-11-10T15:23:23.893Z","cwes":["CWE-863"],"updated_at":"2026-11-10T16:39:23.649176Z"}],"euvd":[{"id":"EUVD-2026-121243","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:23:23Z","modified":"2026-11-10T15:23:23Z","updated_at":"2026-11-10T20:23:11.353031Z"}],"ghsa":[{"id":"GHSA-hp35-79g6-r3v6","title":"When resolving security roles of a realm-authenticated caller, the caller's user name is also...","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T18:31:37Z","modified":"2026-11-10T18:31:38Z","cwes":["CWE-863"],"updated_at":"2026-11-10T18:56:09.133019Z"}],"nvd":[{"id":"CVE-2026-111247","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T16:17:15.577Z","modified":"2026-11-12T17:06:26.857Z","cwes":["CWE-863"],"updated_at":"2026-11-10T18:20:10.790002Z"}]}}