Sensitive Information Exposure in Apache Roller Blog Platform by Apache

CVE-2026-105152

What is CVE-2026-105152?

A vulnerability in Apache Roller allows weblog administrators to inadvertently access another user's stored password hash through manipulated custom templates. The flaw lies in the improper exposure of wrapper classes that should limit visibility to specific data fields. By exploiting this vulnerability, an untrusted template can directly access sensitive underlying objects, compromising user security without requiring any unusual configuration. It affects all installations where the administrator has the ability to create templates, highlighting the necessity for users to upgrade to Apache Roller version 6.1.7 or later, which rectifies access to these underlying objects.

References