Severity: Important
CVSS 3.1: 7.7 (high) CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
Affected versions:
- Apache Roller 6.1.5
Description:
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows
an authenticated user with authoring rights on one weblog to read, modify, or
delete resources belonging to another weblog through unscoped identifier-based
lookups. This affects multi-user installations where users are intended to be
isolated between weblogs; no optional feature or non-default configuration is
required. A user with administrator rights on their weblog can also overwrite
another weblog's Velocity template, whose content is evaluated when the victim
weblog renders. Users are recommended to upgrade to Apache Roller 6.1.6 or
later, which scopes authoring resource lookups to the acting weblog.
Credit:
meifukun (finder)
n0mi1k (finder)
Ivan Iushkevich (Steph) (finder)
References:
https://github.com/apache/roller/pull/162
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-82348
