VulnerabilityPublished 14 Apr 2025Updated 26 Feb 2026

CVE-2025-24859: Apache Roller · Insufficient Session Expiration

Affects Apache RollerSource CVE Database V5

Not known to be exploited · CVSS 2.1 Low · fixed in 6.1.5 : update Apache Roller when convenient.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 4.0 base score

2.1Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 1.1% chance of exploitation in 30 days – higher than 66% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 6.1.5

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/S:N/AU:N/R:U/RE:L/U:Amber

Base metrics

Attack Vector: Network
Attack Complexity: High
Attack Requirements: None
Privileges Required: High
User Interaction: None
Vulnerable system confidentiality: Low
Vulnerable system integrity: Low
Vulnerable system availability: None
Subsequent system confidentiality: Low
Subsequent system integrity: Low
Subsequent system availability: None

Supplemental metrics

Safety: Negligible
Automatable: No
Recovery: User
Vulnerability Response Effort: Low
Provider Urgency: Amber

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques, for example, circumvention of address space randomization (ASLR) or data execution prevention (DEP) must be performed for the attack to be successful; Obtaining target-specific secrets. The attacker must gather some target-specific secret before the attack can be successful. A secret is any piece of information that cannot be obtained through any amount of reconnaissance. To obtain the secret the attacker must perform additional attacks or break otherwise secure measures (e.g. knowledge of a secret key may be needed to break a crypto channel). This operation must be performed for each attacked target.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: High: The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Vulnerable System.
Vulnerable system integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System.
Subsequent system integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
Safety: Negligible: Consequences of the vulnerability meet definition of IEC 61508 consequence category "negligible."
Automatable: No: Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation.
Recovery: User: The system requires manual intervention by the user to recover services, after an attack has been performed.
Vulnerability Response Effort: Low: The effort required to respond to a vulnerability is low/trivial. Examples include: communication on better documentation, configuration workarounds, or guidance from the vendor that does not require an immediate update, upgrade, or replacement by the consuming entity, such as firewall filter configuration.
Provider Urgency: Amber: Provider has assessed the impact of this vulnerability as having a moderate urgency.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Apr 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Mavenorg.apache.roller/roller`pkg:maven/org.apache.roller/roller`Other threats	Affected <=6.1.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Organizations should upgrade Apache Roller installations to version 6.1.5 or later, where the vulnerability is fixed by proper session invalidation upon password changes. Until upgrading is possible, administrators should consider implementing manual session invalidation procedures, such as forcing all users to log out after password resets or disabling user accounts temporarily. Monitoring active sessions and implementing session timeout policies can reduce the window of exposure. Additionally, integrating Apache Roller with centralized authentication and session management solutions (e.g., Single Sign-On with session revocation capabilities) can help mitigate risks. It is also advisable to audit logs for unusual session activity following password changes and educate users on the importance of logging out from all devices after password updates. Finally, restricting administrative privileges and enforcing strong password policies reduce the likelihood of session compromise.

Description

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

Impact

The primary impact of this vulnerability is unauthorized access persistence. If an attacker or unauthorized party has access to a valid session token before a password change, they can continue to access the affected Apache Roller instance even after the legitimate user changes their password. This undermines the security benefit of password changes, which are often performed in response to suspected compromise. For organizations, this could lead to unauthorized content modification, data leakage, or further lateral movement within the network if Apache Roller is integrated with other systems. The impact is somewhat limited by the need for the attacker to already have an active session or session token, and the relatively low privilege level required to exploit it. However, in environments where Apache Roller is used for sensitive or high-profile blogging or content management, the risk of persistent unauthorized access could be significant. The vulnerability does not affect system availability or integrity directly but compromises session confidentiality and access control mechanisms.

Summary

CVE-2025-24859 identifies a session management vulnerability in Apache Roller, an open-source Java-based blogging platform maintained by the Apache Software Foundation. The issue affects all versions up to and including 6.1.4. Specifically, when a user changes their password—whether by self-service or administrator action—the application fails to invalidate existing active sessions associated with that user. This means that any session tokens or cookies established prior to the password change remain valid and can be used to access the application without re-authentication. This behavior violates secure session management best practices and is categorized under CWE-613 (Insufficient Session Expiration). The root cause is the lack of centralized session invalidation logic triggered by password changes or user account disablement. The vulnerability was addressed in Apache Roller 6.1.5 by introducing a centralized session management mechanism that ensures all active sessions for a user are terminated immediately upon password update or account disablement. The CVSS 4.0 vector indicates network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:H), no user interaction (UI:N), and low impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:N). No known exploits have been reported, suggesting limited active exploitation. However, the vulnerability could be leveraged by attackers who have obtained session tokens or have access to active sessions, bypassing password changes as a security control.

CWE-613Insufficient Session Expiration (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Implementation
Set sessions/credentials expiration date.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.8.1 (opens in a new tab)
V2.8.6 (opens in a new tab)
V3.6.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Feb 2026, 19:54 UTC

WeaknessesCWE-613

Technical details

References

Community reviews

Related threats