Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required. Users are recommended to upgrade to Apache Roller 6.1.6 or later.
CVE-2026-82379 is an authentication bypass vulnerability in Apache Roller 6.1.5 affecting installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage. The flaw allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority due to lack of nonce uniqueness and timestamp freshness enforcement. Apache Roller 6.1.6 and later remove WSSE as an AtomPub authentication method, mitigating this issue.
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser. No optional feature or non-default configuration is required; this affects weblogs with multiple authors or administrators who are not mutually trusted. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which moves those values out of JavaScript literals and writes them as text.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. This affects only weblogs that use the bundled frontpage theme, and a victim must follow a crafted link for the script to execute. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates and contextually escapes the reflected parameter.
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.
Apache Roller 6.1.5 contains a critical deserialization vulnerability in its XML-RPC endpoint that allows unauthenticated remote attackers to cause deserialization of attacker-controlled data. This occurs because the endpoint accepts vendor extension types that are deserialized before authentication, even if the XML-RPC feature is disabled globally. This flaw can lead to remote code execution. Upgrading to Apache Roller 6.1.6 or later mitigates the issue by disabling these extension types and rejecting requests when XML-RPC is disabled.
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.
Apache Roller 6.1.5 contains an XML External Entity (XXE) vulnerability that allows users with entry-editing rights to cause the server to parse attacker-controlled XML data without disabling external entity resolution. This can lead to disclosure of files readable by the Roller process. The vulnerable feature involves the Trackback response parser, which is hidden in the UI but accessible directly. Upgrading to Apache Roller 6.1.6 or later removes the vulnerable parser and mitigates the issue.
Apache Roller 6.1.5 contains a missing authorization vulnerability in its legacy XML-RPC Blogger and MetaWeblog APIs. Authenticated users can read, modify, or delete content from other weblogs because the API handlers authenticate the caller but do not verify permissions on the affected weblog or entry. This issue affects installations with the non-default global XML-RPC setting enabled. The vulnerability is fixed in Apache Roller 6.1.6 by adding explicit per-method permission checks. Users are advised to upgrade or disable the XML-RPC feature to mitigate the risk.
Apache Roller 6.1.5 contains an incorrect authorization vulnerability in its OAuth 1.0a authorization endpoint. This flaw allows an unauthenticated remote attacker who knows an outstanding request token for a configured site-wide consumer to bind that token to any user account, including administrators, by submitting an unsigned authorization request. The vulnerability arises because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. Only installations with an OAuth 1.0a site-wide consumer configured are affected. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by binding authorization to the logged-in session.
Apache Roller 6.1.5 contains a vulnerability that allows a weblog administrator to read sensitive files on the application classpath, including configuration files with secrets. This is possible because the Velocity template engine's include and parse directives are not confined by the sandbox that treats weblog administrators as untrusted. The issue is fixed in Apache Roller 6.1.6, which restricts includes to the active theme and removes classpath resource loading from weblog rendering.
CVE-2026-82386 is a high-severity vulnerability in Apache Roller 6.1.5 involving improper restriction of XML External Entity (XXE) references. It allows a weblog administrator to read files accessible to the Roller process and access internal network addresses by importing a crafted OPML document. This occurs because the bookmark import parser does not disable external entity resolution. No special configuration is needed to exploit this; the vulnerability is triggered via the administrator bookmark-import action. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by using a hardened parser that disables external entities and document type declarations.
Apache Roller 6.1.5 contains an authorization bypass vulnerability that allows an authenticated user with authoring rights on one weblog to access and modify resources of another weblog. This affects multi-user installations without requiring special configuration. The flaw also permits an administrator on one weblog to overwrite another weblog's Velocity template, potentially affecting content rendering. Upgrading to version 6.1.6 or later mitigates this issue by scoping resource lookups to the acting weblog.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue arises because the media upload feature trusts the content type supplied during upload and serves the stored file with that type, allowing a user with media-upload rights to store active content. Media uploads are disabled by default, so only installations that enable this feature are affected. The vulnerability is fixed in Apache Roller 6.1.6, which derives the stored content type from the file content and serves non-image media as downloads.
Apache Roller 6.1.5 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An anonymous remote attacker can store a comment with a javascript: URI link that bypasses HTML comment formatting and executes script when clicked by a visitor. This issue affects sites with HTML enabled in comments and using the HTMLSubset comment formatter. The vulnerability is fixed in Apache Roller 6.1.6 and later by restricting restored links to http, https, and mailto URIs.
Apache Roller 6.1.5 contains a reflected cross-site scripting (XSS) vulnerability in the optional LDAP comment authenticator. This flaw allows remote attackers to inject malicious scripts via crafted request parameters that are reflected in the authenticator's HTML form without proper escaping. The vulnerability affects only sites configured to use LdapCommentAuthenticator and requires the victim to have an active session with the authenticator form loaded. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by escaping reflected values.
A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised.
This issue affects Apache Roller versions up to and including 6.1.4.
The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.