Apache Roller 6.1.5 contains an SSRF vulnerability (CWE-918) that can be exploited by authenticated users with entry-editing permissions. The flaw exists in legacy outbound Trackback and entry enclosure handling, allowing attackers to trigger HTTP requests from the server to attacker-chosen destinations, including loopback and private network addresses. The Trackback control is hidden in the UI but remains accessible, and the enclosure feature exposes response metadata such as status, content type, and length. No special server configuration is required, and the default empty Trackback allow-list permits all outbound destinations. Apache Roller 6.1.6 and later versions remove the vulnerable Trackback action and stop dereferencing enclosure URLs, mitigating the issue.

An authenticated user with entry-editing rights can exploit this SSRF vulnerability to make the server perform HTTP requests to arbitrary external or internal network addresses. This can lead to information disclosure (response status, content type, and length) and potentially facilitate further attacks within the internal network or against other systems accessible from the server. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Users should upgrade to Apache Roller version 6.1.6 or later, which removes the vulnerable outbound Trackback action and disables enclosure URL dereferencing. This official fix fully mitigates the SSRF vulnerability. No additional configuration changes are required if upgraded.