CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering
Apache Roller 6.1.5 lets unauthenticated attackers persistently change the site frontpage weblog selection.
46
Vulnerability1 · 1 read
CVE-2026-82383
Missing authentication lets attackers change Apache Roller frontpage
- CVSS 3.1
- 8.2 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Roller 6.1.5 is missing an authentication check on a critical setup function that stays reachable by anonymous users after installation. A remote attacker can call that action with no login and no special configuration and persistently change the site-global frontpage weblog selection. That change can redirect or break the site's public frontpage; confidentiality is not affected, and an administrator can recover the setting. Only installations of Apache Roller 6.1.5 are identified as affected, and the vendor recommends 6.1.6 or later. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade Apache Roller to 6.1.6 or later, which limits this write to global administrators. After upgrading, confirm the frontpage weblog selection was not changed by an unauthenticated caller and restore it from an administrator account if the public frontpage was redirected or broken.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Roller | 6.1.5 |
Estimated exposure
nichehundreds to low thousands of installations — Apache Roller is a niche self-hosted Java blog server with no large public install census or internet-scan count in the advisory, so only an order-of-magnitude estimate is possible.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.
- Weakness
- CWE-306
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L