Apache Software Foundation Apache Roller vulnerabilities

CVE-2026-82384 [CRITICAL] CWE-502 CVE-2026-82384: Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker t Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when

CVE-2026-82378 [CRITICAL] CWE-863 CVE-2026-82378: Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an un Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint deri

CVE-2026-82377 [CRITICAL] CWE-862 CVE-2026-82377: Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations th

CVE-2018-17198 [CRITICAL] CWE-918 CVE-2018-17198: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnera

CVE-2026-82379 [HIGH] CWE-294 CVE-2026-82379: Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a val Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authenti

CVE-2026-82383 [HIGH] CWE-306 CVE-2026-82383: Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization

CVE-2025-24859 [HIGH] CWE-613 CVE-2025-24859: A session management vulnerability exists in Apache Roller before version 6.1.5 where active user se A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old

CVE-2026-82376 [HIGH] CWE-611 CVE-2026-82376: Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entr Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process. The Trackback control

CVE-2026-82348 [HIGH] CWE-639 CVE-2026-82348: Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users are intended to be isolated between weblogs; no optional f

CVE-2026-82386 [HIGH] CWE-611 CVE-2026-82386: Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog adminis Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the

CVE-2026-82375 [HIGH] CWE-918 CVE-2026-82375: Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-ed Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the e

CVE-2021-33580 [HIGH] CWE-400 CVE-2021-33580: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryStrin User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex ca

CVE-2026-82380 [HIGH] CWE-352 CVE-2026-82380: Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged- Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No

CVE-2026-82385 [MEDIUM] CWE-200 CVE-2026-82385: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog ad Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats we

CVE-2026-86507 [MEDIUM] CWE-79 CVE-2026-86507: Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequent

CVE-2026-82546 [MEDIUM] CWE-79 CVE-2026-82546: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow th

CVE-2023-37581 [MEDIUM] CWE-79 CVE-2023-37581: Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author ra

CVE-2026-91206 [MEDIUM] CWE-79 CVE-2026-91206: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. This affects only sites configured to use LdapComment

CVE-2026-91204 [MEDIUM] CWE-79 CVE-2026-91204: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. This affects only sites that enable HTML in comment

CVE-2024-25090 [MEDIUM] CWE-20 CVE-2024-25090: Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & descripti Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust y