CVE-2026-82377

Apache Roller 6.1.5 has a missing-authorization flaw (CWE-862) in its legacy XML-RPC Blogger and MetaWeblog API handlers. An authenticated user can read, modify, or delete content that belongs to other weblogs because the handlers authenticate the caller but do not check that caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for weblogs created through the UI. The issue is rated critical (CVSS 3.1 9.9) because a low-privileged remote attacker can cross weblog boundaries and affect confidentiality, integrity, and availability. No public proof of concept is known and the CVE is not in CISA KEV, so exploitation in the wild is not known.

What to do: Upgrade to Apache Roller 6.1.6 or later, which adds an explicit per-method permission check on the XML-RPC handlers. If you cannot upgrade immediately, keep the global XML-RPC feature disabled. Confirm whether that non-default setting is enabled and review weblog entries for unexpected reads, edits, or deletions by authenticated users who should not have had access.