{"id":"CVE-2026-111242","published":"2026-11-10T16:17:14.967","lastModified":"2026-11-10T16:17:14.967","description":"When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-488"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}