CVE-2026-82383

HIGH 8.2

Apache Roller: Anonymous setup action allows frontpage configuration tampering

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.

CWE	CWE-306
Vendor	apache software foundation
Product	apache roller
Published	Sep 28, 2026
Last Updated	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache roller

Be the first to know when new high vulnerabilities affecting apache software foundation apache roller are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

Apache Software Foundation / Apache Roller

6.1.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/roller/pull/170 lists.apache.org: https://lists.apache.org/thread/7oof135zr05zfkslj9s6m5o0brll47dz openwall.com: http://www.openwall.com/lists/oss-security/2026/09/25/16

Credits

meifukun