Threats tagged 'ghsa-q96p-m6xp-j9ch'

Apache Roller versions 4.0 through 6.1.6 contain a missing authorization vulnerability that allows any logged-in user to read unpublished weblog entries for which they have no assigned role. The vulnerability arises because the entry preview function only verifies that the user is logged in, but does not check if the user has permission for the specific weblog. Exploitation requires knowledge of the weblog name and the entry's link name. Upgrading to Apache Roller 6.1.7 or later mitigates this issue by enforcing role checks before previewing entries.