CVE-2026-118408
LOW
INFO
Priority: 0.01
BB Relevance:
46/100
Published: 2026-11-11
Modified: 2026-11-12
First seen: 2026-11-11
Status: active
Attack Surface
Network
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
Low
I:
None
A:
None
Description
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Roller | 4.0 |
References & Advisories (2)
vendor-advisory
patch