CVE-2026-82378
CriticalCVSS 9.0Summary
Apache Roller 6.1.5 contains an Incorrect Authorization vulnerability in the OAuth 1.0a authorization endpoint. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session.
Risk Assessment
An attacker could take over any account, including an administrator account, leading to full application compromise. The vulnerability only affects installations with a configured OAuth 1.0a site-wide consumer and requires knowledge of an outstanding request token.
Recommendation
Upgrade Apache Roller to version 6.1.6 or later, which binds authorization to the logged-in session.
Other vulnerabilities in Apache Roller
See all- CVE-2026-86507Medium
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required.
- CVE-2026-91206Medium
Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 occurs in the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. The attack requires the victim to follow a crafted link, and the site must be configured with LdapCommentAuthenticator.
- CVE-2026-91204Medium
Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an anonymous attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. Affects only sites with HTML in comments enabled (users.comments.htmlenabled=true) and HTMLSubset formatter.
- CVE-2026-82546Medium
Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an unauthenticated attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin.
- CVE-2026-82387Medium
Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back with that type. A victim who opens the uploaded file executes the stored script. Media uploads are disabled by default; only installations that enable them are affected.
- CVE-2026-82386High
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution.
- CVE-2026-82385Medium
Exposure of Sensitive Information vulnerability in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it.
- CVE-2026-82383High
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check.
- CVE-2026-82382Medium
Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. Affects only weblogs using the bundled frontpage theme, and a victim must follow a crafted link.
- CVE-2026-82381Medium
Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser. No optional feature or non-default configuration is required; affects weblogs with multiple authors or administrators who are not mutually trusted.
Original NVD description (English source)
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session. Only installations that configure an OAuth 1.0a site-wide consumer are affected, and exploitation requires knowledge of one of its outstanding request tokens. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which binds authorization to the logged-in session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS