Authorization Flaw in Apache Roller by Apache Software Foundation

CVE-2026-122300

What is CVE-2026-122300?

A missing authorization vulnerability in Apache Roller versions 4.0 through 6.1.6 allows a weblog member assigned the Limited role to alter or delete entries that they should only have permission to read. This issue arises because the entry editor verifies the member's weblog role without checking if that role is authorized to perform actions on the entries. Users are strongly encouraged to upgrade to Apache Roller version 6.1.7 or later to mitigate this security risk.

References