{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.apache.openejb:openejb-core","product":"Apache TomEE","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.5.1","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.apache.tomee:openejb-core","product":"Apache TomEE","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"cveId":"CVE-2026-87756","cwes":["CWE-306"],"description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794322639763,"publishedAt":1794322639763,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r"}],"remediation":[],"revision":"43c582413e55c73d78b8a128f8a09a59c5fe8c32147e21daee4cbefc577d3cc6","sources":[{"modifiedAt":1794322639763,"name":"CNA: apache","retrievedAt":1794323479678,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87756"}],"ssvc":null,"status":"published","title":"Apache TomEE: Missing authorization on internal deployer EJBs in default profile","updatedAt":1794323479678}