Improper Authentication in Apache Roller Affects User Account Security
CVE-2026-118412

3.1LOW

Key Information:

Vendor

Apache
Status
Apache Roller
Vendor
CVE Published:
11 November 2026

What is CVE-2026-118412?

A vulnerability in Apache Roller versions 5.1.0 to 6.1.6 allows disabled user accounts to log in via OpenID without proper validation of account status. This oversight enables unauthorized access to unpublished entries, posing a risk for sensitive information exposure. The issue affects only installations that have activated the non-standard OpenID authentication feature. Users are urged to upgrade to Apache Roller version 6.1.7 or higher to mitigate this risk.

Affected Version(s)

Apache Roller 5.1.0 <= 6.1.6

References

https://github.com/apache/roller/pull/224
patch
https://lists.apache.org/thread/lmlcrh06ynr0tfgg2f7vwh3h9...
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hataehoon (GitHub: dpfkdlemtp)
.