CVE-2026-82378

Apache Roller 6.1.5 has an incorrect-authorization flaw (CWE-863) in its OAuth 1.0a authorization endpoint. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can submit an unsigned authorization request that binds that token to an arbitrary account, including an administrator, because the endpoint takes the authorizing identity from a request-supplied value instead of the authenticated session. A successful bind can let the attacker act as that user, with critical confidentiality, integrity, and availability impact (CVSS 9.0), though complexity is high because a live request token must be known. Only installations that configure an OAuth 1.0a site-wide consumer are affected. No public proof of concept is known and the issue is not listed in CISA KEV.

What to do: Upgrade Apache Roller to 6.1.6 or later, which binds OAuth authorization to the logged-in session. Until upgraded, do not configure an OAuth 1.0a site-wide consumer unless it is required, and review outstanding request tokens and any unexpected bindings to user or administrator accounts.