CVE-2026-118408
Apache Roller: Unpublished entries of other weblogs readable through preview
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.
| CWE | CWE-862 |
| Vendor | apache software foundation |
| Product | apache roller |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache roller
Be the first to know when new low vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Apache Software Foundation / Apache Roller
4.0 ≤ 6.1.6
References
Credits
hataehoon (GitHub: dpfkdlemtp)