CVE-2026-118412: Apache Roller: Disabled accounts can sign in through OpenID
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.7
Event History
Frequently Asked Questions
Which deployments are affected?
Only Apache Roller sites that have enabled the non-default OpenID authentication mode are affected. Deployments using the default authentication configuration are not affected by this issue.
What access does an attacker need to exploit this?
The attacker needs an Apache Roller account that an administrator has disabled and must be able to authenticate through the OpenID sign-in path. That path can allow the disabled account to sign in and read unpublished entries.
How can I determine whether my site is exposed?
Check whether the deployment runs Apache Roller 5.1.0 through 6.1.6 and has non-default OpenID authentication enabled. A disabled account that can still successfully sign in through OpenID indicates the issue is present.
What should be done if the installation is affected?
Upgrade to Apache Roller 6.1.7 or later. If an immediate upgrade is not possible, disable the non-default OpenID authentication mode to remove the affected sign-in path.