Missing Authorization Vulnerability in Apache Roller by Apache

CVE-2026-118408

What is CVE-2026-118408?

Apache Roller versions 4.0 through 6.1.6 are vulnerable due to a missing authorization control, allowing any logged-in user to view unpublished entries of a weblog where they lack appropriate roles. This vulnerability stems from the insufficient validation during entry previews, which only requires a user to be logged in without verifying their role within the specific weblog. Attackers need to know the weblog name and the specific entry's link name to exploit this issue. Users are encouraged to upgrade to Apache Roller version 6.1.7 or later, which includes necessary role checks.

References