Cross-Site Request Forgery Vulnerability in Apache Roller by Apache

CVE-2026-82380

What is CVE-2026-82380?

A vulnerability in Apache Roller 6.1.5 allows attackers to exploit Cross-Site Request Forgery (CSRF) weaknesses. This issue enables a remote attacker to manipulate an authenticated user's actions without their consent, as the CSRF filtering mechanism inadequately verifies the required salt token, instead accepting a value created by the server. This vulnerability impacts authors and administrators who are tricked into visiting malicious websites. To mitigate this risk, users must upgrade to Apache Roller 6.1.6 or later, which strengthens salt validation and applies necessary checks to multipart forms.

References