CSRF Vulnerability in Apache Roller Affects Multiple Versions

CVE-2026-118411

What is CVE-2026-118411?

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Roller versions 5.0.1 through 6.1.6, which permits an unauthenticated attacker to create an administrator account by deceiving a logged-in Roller administrator into clicking a malicious link. This vulnerability stems from insufficient request token validation, which is only enforced for POST requests; GET requests, which can also trigger administrative actions, are not subjected to this check. To mitigate this issue, upgrading to Apache Roller version 6.1.7 or later is strongly recommended, as these versions implement required POST requests along with valid token verification for all data-altering actions.

References