CVE-2026-122300: Apache Roller: Limited weblog members can remove or change published entries

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Roller to a version that resolves this vulnerability.
Fixed in 6.1.7

Event History

Nov 11, 2026

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated member of a weblog who has the Limited role can exploit it. The affected permissions allow that member to change or remove entries they should only be able to read, including entries published by other members.

Are deployments affected by default?

A deployment is affected if it uses Apache Roller versions 4.0 through 6.1.6 and has weblog members assigned the Limited role. The issue requires a Limited-role member account; it is not described as exploitable anonymously.

What is the recommended remediation?

Upgrade Apache Roller to version 6.1.7 or later. If an immediate upgrade is not possible, avoid assigning the Limited role to untrusted users, since those accounts can modify or delete entries beyond their intended permissions.

How can I determine whether unauthorized changes may have occurred?

Review published entries for unexpected edits or deletions involving weblogs with Limited-role members. The provided information does not identify a specific log event or indicator for detecting exploitation.

CVE-2026-122300: Apache Roller: Limited weblog members can remove or change published entries

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What is the recommended remediation?

How can I determine whether unauthorized changes may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What is the recommended remediation?

How can I determine whether unauthorized changes may have occurred?