CVE-2026-82380

Apache Roller 6.1.5 has a cross-site request forgery flaw because its CSRF filters accept a state-changing request that omits the required salt and instead validate against a salt the server itself generated for that request. A remote attacker can exploit this by inducing a logged-in author or administrator to open a crafted page, so the victim's browser performs actions under that user's authority; no optional feature or non-default configuration is required. Impact is to integrity and availability of those authorized actions (CVSS 8.1, C:N/I:H/A:H), not direct confidentiality loss. Every logged-in author or administrator on an affected 6.1.5 instance is in scope. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Apache Roller to 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms. Until then, avoid using author or administrator sessions while browsing untrusted pages, and after upgrading confirm that state-changing requests without a valid submitted salt are rejected.