CVE-2026-82348 is an authorization bypass vulnerability in Apache Roller version 6.1.5. It allows an authenticated user with authoring rights on one weblog to perform unauthorized actions such as reading, modifying, or deleting resources belonging to other weblogs due to unscoped identifier-based lookups. Additionally, users with administrator rights on their weblog can overwrite another weblog's Velocity template, potentially affecting the victim weblog's rendering. This vulnerability affects multi-user installations where weblogs are intended to be isolated. The issue is fixed in Apache Roller 6.1.6 by scoping authoring resource lookups to the weblog of the acting user.

An attacker with authoring rights on one weblog can bypass authorization controls to access and manipulate resources of other weblogs, violating intended isolation in multi-user environments. This includes the ability to read, modify, or delete content and overwrite Velocity templates, which could lead to code execution or content manipulation when the victim weblog renders. The vulnerability has a CVSS 3.1 score of 7.7 (high severity), indicating significant impact on confidentiality, integrity, and availability.

Users should upgrade to Apache Roller version 6.1.6 or later, where the vulnerability is fixed by scoping authoring resource lookups to the acting weblog. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 6.1.6.