Severity: Moderate
CVSS 3.1: 3.1 (low) CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions:
- Apache Roller 4.0 through 6.1.6
Description:
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in
user to read unpublished entries of a weblog they have no role in. The entry
preview checked that the user was logged in, but not that the user had a role
in the weblog being previewed. The attacker must know the weblog name and the
entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or
later, which requires a role in the weblog to preview its entries.
Credit:
hataehoon (GitHub: dpfkdlemtp) (finder)
References:
https://github.com/apache/roller/pull/223
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118408
