Apache Roller vulnerabilities

Latest Apache Roller CVEs

Newest publication first · page 1 of 2

1. CVE-2026-123374 Apache Roller: Deserialization of untrusted data in weblog update ping responses

   Published 2026-11-11

   Unknown EPSS 0.40%

   Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. Th...

2. CVE-2026-122300 Apache Roller: Limited weblog members can remove or change published entries

   Published 2026-11-11

   Unknown EPSS 0.19%

   Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not wheth...

3. CVE-2026-118414 Apache Roller: Stored cross-site scripting through the weblog description

   Published 2026-11-11

   Medium·CVSS 5.4 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kep...

4. CVE-2026-118413 Apache Roller: Stored cross-site scripting through imported blogroll links

   Published 2026-11-11

   Medium·CVSS 5.4 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, an...

5. CVE-2026-118412 Apache Roller: Disabled accounts can sign in through OpenID

   Published 2026-11-11

   Low·CVSS 3.1 EPSS 0.29%

   Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the n...

6. CVE-2026-118411 Apache Roller: Cross-site request forgery through GET requests to administrative actions

   Published 2026-11-11

   High·CVSS 8.8 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and adm...

7. CVE-2026-118410 Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish

   Published 2026-11-11

   Low·CVSS 3.7 EPSS 0.28%

   Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search s...

8. CVE-2026-118409 Apache Roller: Commenter email addresses recoverable through public search

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.34%

   Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search acc...

9. CVE-2026-118408 Apache Roller: Unpublished entries of other weblogs readable through preview

   Published 2026-11-11

   Low·CVSS 3.1 EPSS 0.25%

   Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker mus...

10. CVE-2026-111824 Apache Roller: Stored cross-site scripting through custom-theme resource URLs

    Published 2026-11-11

    Unknown EPSS 0.22%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL....

11. CVE-2026-108338 Apache Roller: Stored cross-site scripting through AtomPub entry tags

    Published 2026-11-11

    Unknown EPSS 0.22%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML charac...

12. CVE-2026-105154 Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLs

    Published 2026-11-11

    Medium·CVSS 6.1 EPSS 0.13%

    Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administra...

13. CVE-2026-105153 Apache Roller: XML external entity processing in AtomPub entry parsing

    Published 2026-11-11

    High·CVSS 7.7 EPSS 0.46%

    Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by s...

14. CVE-2026-105152 Apache Roller: Weblog template access to wrapped objects exposes another user's password hash

    Published 2026-11-11

    Medium·CVSS 4.3 EPSS 0.29%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or...

15. CVE-2026-118405 Apache Roller: Exposure of other users' email addresses through the user search

    Published 2026-11-11

    Medium·CVSS 4.3 EPSS 0.29%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addre...

16. CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL

    Published 2026-09-28

    Medium·CVSS 6.1 EPSS 0.25%

    Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites th...

17. CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed

    Published 2026-09-28

    High·CVSS 7.7 EPSS 0.37%

    Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only...

18. CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

    Published 2026-09-28

    High·CVSS 8.1 EPSS 0.21%

    Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validatin...

19. CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI

    Published 2026-09-28

    Medium·CVSS 5.4 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without p...

20. CVE-2026-82382 Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

    Published 2026-09-28

    Medium·CVSS 6.1 EPSS 0.25%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory pa...

21. CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

    Published 2026-09-28

    High·CVSS 8.2 EPSS 0.49%

    Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachabl...

22. CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

    Published 2026-09-28

    Critical·CVSS 9.8 EPSS 0.99%

    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authenticatio...

23. CVE-2026-82375 Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

    Published 2026-09-28

    High·CVSS 7.4 EPSS 0.29%

    Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hi...

24. CVE-2026-82376 Apache Roller: XML external entity processing in trackback response parser

    Published 2026-09-28

    High·CVSS 7.7 EPSS 0.30%

    Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to...

25. CVE-2026-82377 Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

    Published 2026-09-28

    Critical·CVSS 9.9 EPSS 0.41%

    Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.