Sensitive Information Exposure in Apache Roller by Apache

CVE-2026-118409

What is CVE-2026-118409?

An existing vulnerability in Apache Roller versions 4.0 through 6.1.6 allows unauthorized individuals to gain access to sensitive information, specifically the email addresses of users who have left approved comments. Through a public weblog search feature that permits wildcard queries, attackers can retrieve commenter email addresses with a single character confirmation at a time. It is critical for users to upgrade to Apache Roller version 6.1.7 or later and to rebuild their search indexes to ensure data privacy and security against such threats.

References