CVE-2026-111247 | BDVDB-2026-402955 Detail

Description#

When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-10Record published in the CVE List.