Severity: Important
CVSS 3.1: 8.8 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected versions:
- Apache Roller 5.0.1 through 6.1.6
Description:
Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows
an unauthenticated attacker to create an administrator account if a logged-in
Roller administrator opens a link that the attacker controls. The request-token
check applied only to POST requests, and administrative actions also accepted
GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later,
which requires POST and a valid token for actions that change data.
Credit:
hataehoon (GitHub: dpfkdlemtp) (finder)
References:
https://github.com/apache/roller/pull/227
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118411
