CVE-2026-118411
Apache Roller: Cross-site request forgery through GET requests to administrative actions
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.
| CWE | CWE-352 |
| Vendor | apache software foundation |
| Product | apache roller |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache roller
Be the first to know when new high vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Apache Software Foundation / Apache Roller
5.0.1 ≤ 6.1.6
References
Credits
hataehoon (GitHub: dpfkdlemtp)