{"id":"CVE-2026-111247","published":"2026-11-10T16:17:15.577","lastModified":"2026-11-10T16:17:15.577","description":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}