Threats tagged 'ghsa-7jhv-jpvr-w92r'

Apache Roller versions 4.0 through 6.1.6 contain a missing authorization vulnerability that allows weblog members with the Limited role to remove or modify entries they should only be able to read, including entries published by other members. This occurs because the entry editor verifies the member's weblog role but does not check if that role permits modification of the specific entry. Users are advised to upgrade to version 6.1.7 or later to address this issue.