Cross-Site Request Forgery in Apache Roller Administration

CVE-2026-105154

What is CVE-2026-105154?

A vulnerability in the Planet feed aggregator administration of Apache Roller, from version 4.0 to 6.1.6, permits unauthenticated attackers to exploit cross-site request forgery. By enticing a logged-in global administrator to visit a malicious webpage, an attacker can have the Roller server fetch a chosen URL, which can include internal addresses. This exploit occurs due to the problematic handling of GET requests in the Planet aggregator that bypasses CSRF token protections. As a result, any content fetched and interpreted as a feed can be published to the aggregated Planet feed without proper authentication. It is essential for users to upgrade to Apache Roller version 6.1.7 or later to mitigate this issue, which requires POST requests accompanied by a valid CSRF token for any administrative changes to the Planet aggregator, now disabled by default.

References