CVE-2026-118410: Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish

Published Nov 11, 2026

Updated

Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Roller to a version that resolves this vulnerability.
Fixed in 6.1.7

Event History

Nov 11, 2026

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache Roller installations from 4.0 through 6.1.6 are affected if authors use the AtomPub API to withdraw published entries to drafts and public search is available. Because AtomPub is disabled by default, installations that have not enabled it are not exposed through this workflow.

What does an attacker need to exploit it?

No authentication or user interaction is required. An unauthenticated visitor only needs to search for content from an entry that was unpublished through AtomPub but remains in the search index.

How can I tell whether content may already be exposed?

Review entries that were changed from published to draft using AtomPub, then perform public searches for text from those entries. If search results still display the withdrawn entry's content, it remains exposed.

What should I do if I cannot upgrade immediately?

Disable AtomPub if it is enabled, and review public search results for content from entries withdrawn through AtomPub. Upgrade to Apache Roller 6.1.7 or later when possible; that version limits search results to published entries.

CVE-2026-118410: Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether content may already be exposed?

What should I do if I cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether content may already be exposed?

What should I do if I cannot upgrade immediately?