Sensitive Information Exposure in Apache Roller by Apache

CVE-2026-118405

What is CVE-2026-118405?

Apache Roller versions 4.0 to 6.1.6 are susceptible to a vulnerability where any logged-in user can exploit the user search functionality to expose other users' email addresses. Although usernames are displayed, the underlying matching mechanism inadvertently allows attackers to guess email addresses by confirming each character in a user’s email. This vulnerability may lead to unauthorized access to sensitive user information, posing a risk to the privacy of all users. Upgrading to Apache Roller 6.1.7 or later is critical, as it restricts search functionality to usernames exclusively for non-administrator users.

References