{"id":"CVE-2026-87756","aliases":["EUVD-2026-121216","GHSA-52g3-qw9c-qp2m"],"status":"published","title":"Apache TomEE: Missing authorization on internal deployer EJBs in default profile","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-11-10T14:57:19Z","modified":"2026-11-10T15:33:45Z","products":[{"vendor":"apache software foundation","product":"apache tomee"}],"references":[{"url":"https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87756"},{"url":"https://github.com/advisories/GHSA-52g3-qw9c-qp2m"}],"sources":{"cve":[{"id":"CVE-2026-87756","title":"Apache TomEE: Missing authorization on internal deployer EJBs in default profile","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T14:57:19.763Z","modified":"2026-11-10T14:57:19.763Z","cwes":["CWE-306"],"updated_at":"2026-11-10T15:39:11.409762Z"}],"euvd":[{"id":"EUVD-2026-121216","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T14:57:19Z","modified":"2026-11-10T14:57:19Z","updated_at":"2026-11-10T17:21:44.86098Z"}],"ghsa":[{"id":"GHSA-52g3-qw9c-qp2m","title":"The internal system EJBs used for remote deployment and configuration did not enforce their...","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:33:37Z","modified":"2026-11-10T15:33:45Z","cwes":["CWE-306"],"updated_at":"2026-11-10T15:55:02.881893Z"}],"nvd":[{"id":"CVE-2026-87756","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:17:30.603Z","modified":"2026-11-10T15:17:30.603Z","cwes":["CWE-306"],"updated_at":"2026-11-10T18:20:10.790002Z"}]}}