CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users are intended to be isolated between weblogs; no optional feature or non-default configuration is required. A user with administrator rights on their weblog can also overwrite another weblog's Velocity template, whose content is evaluated when the victim weblog renders. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which scopes authoring resource lookups to the acting weblog.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Rollerto a version that resolves this vulnerability.Fixed in 6.1.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Roller 6.1.5 multi-user deployments in which users are intended to be isolated between weblogs are affected. No optional feature or non-default configuration is required.
What access does an attacker need?
An attacker must be authenticated and have authoring rights on at least one weblog. They can then use unscoped identifier-based authoring lookups to access resources belonging to another weblog.
What impact is possible across weblog boundaries?
The attacker can read, modify, or delete another weblog's resources. An administrator of one weblog can also overwrite a different weblog's Velocity template, which is evaluated when the victim weblog renders.
What should organizations do to remediate the issue?
Upgrade to Apache Roller 6.1.6 or later. The updated versions scope authoring resource lookups to the acting weblog.