Severity: Low
CVSS 3.1: 3.1 (low) CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions:
- Apache Roller 5.1.0 through 6.1.6
Description:
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user
whose account an administrator has disabled to sign in again through OpenID and
read unpublished entries. The OpenID sign-in path did not check whether the
account was enabled. Only sites that enable the non-default OpenID
authentication mode are affected; later major versions do not include OpenID
2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Credit:
hataehoon (GitHub: dpfkdlemtp) (finder)
References:
https://github.com/apache/roller/pull/224
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118412
