CVE-2026-82348

CVE-2026-82348 is an authorization bypass (CWE-639) in Apache Roller 6.1.5 caused by unscoped identifier-based lookups. An authenticated user who already has authoring rights on one weblog can read, modify, or delete resources that belong to another weblog; no optional feature or non-default configuration is required. A user with administrator rights on their own weblog can also overwrite another weblog's Velocity template, and that template content is evaluated when the victim weblog renders. The issue affects multi-user installations where weblogs are meant to isolate users from each other. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Apache Roller to 6.1.6 or later, which scopes authoring resource lookups to the acting weblog. Until then, treat multi-user installs as exposed: limit who has authoring or weblog-admin rights, and review other weblogs' resources and Velocity templates for unexpected reads, edits, deletions, or overwrites.