CVE-2026-82378 is an incorrect authorization vulnerability (CWE-863) in Apache Roller version 6.1.5. The OAuth 1.0a authorization endpoint improperly authorizes requests by relying on a request-supplied identity rather than the authenticated session. An attacker who knows an outstanding request token for a site-wide OAuth consumer can submit an unsigned authorization request to bind that token to any user account, including administrators. This allows unauthorized privilege escalation. The vulnerability affects only installations with a configured OAuth 1.0a site-wide consumer. The issue is fixed in Apache Roller 6.1.6 and later versions, which enforce authorization based on the logged-in session.

Successful exploitation allows an unauthenticated remote attacker to escalate privileges by binding an outstanding OAuth request token to arbitrary user accounts, including administrative accounts. This results in full compromise of affected user accounts and potentially the entire application. The vulnerability has a CVSS 3.1 score of 9.0 (critical), indicating high impact on confidentiality, integrity, and availability.

Users should upgrade to Apache Roller version 6.1.6 or later, where the authorization process is corrected to bind authorization to the authenticated session. This official fix addresses the incorrect authorization flaw. No other mitigations are specified or recommended by the vendor.