Severity: Moderate
CVSS 3.1: 4.3 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions:
- Apache Roller 4.0 through 6.1.6
Description:
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0
through 6.1.6 allows a weblog administrator to read another user's stored
password hash by authoring a custom weblog template that reaches the wrapped
persistent object behind the template's weblog or entry data, rather than the
reduced set of fields the wrapper is meant to expose. Roller treats weblog
administrators as untrusted and exposes weblog and entry data to templates only
through wrapper classes, but a public accessor on those wrapper classes
returned the underlying persistent object directly, including the stored
password hash of the weblog's creator and of any author whose entry renders on
the page. No non-default configuration is required; this affects any weblog
whose administrator can author templates. Users are recommended to upgrade to
Apache Roller 6.1.7 or later, which removes template access to the underlying
wrapped objects.
Credit:
TungNQ_BMC-VNCSGlobal (finder)
References:
https://github.com/apache/roller/pull/199
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105152
