Input Handling Vulnerability in Apache Roller by Apache
CVE-2026-86507

6.1MEDIUM

Key Information:

Vendor

Apache
Status
Apache Roller
Vendor
CVE Published:
28 September 2026

What is CVE-2026-86507?

An input handling vulnerability in Apache Roller 6.1.5 enables anonymous remote attackers to craft malicious comment-author URLs. When moderators or global administrators view the comment management page, these URLs can execute scripts within their sessions, leading to potential session hijacking. This weakness affects any website that allows comment submissions and has not implemented restrictive server settings. Users are advised to upgrade to Apache Roller 6.1.6 or later to mitigate this risk.

Affected Version(s)

Apache Roller 6.1.5

References

https://github.com/apache/roller/pull/181
patch
https://lists.apache.org/thread/rjyxvm0fgtdfxwkj5qv532htd...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Iushkevich (Steph)
.