CVE-2026-86507

Apache Roller 6.1.5 fails to neutralize the comment-author URL, so an anonymous remote attacker can store a crafted URL in a comment. The payload runs as script in the browser session of a weblog moderator or global administrator when that person views the comment management page. The result is stored cross-site scripting with changed scope, limited confidentiality and integrity impact, and no availability impact; the attacker needs no account, but a moderator must open the moderation page. Sites that allow comments on at least one weblog are affected, and no non-default server setting is required. No public proof of concept is known, and the issue is not in the CISA KEV catalog.

What to do: Upgrade Apache Roller to 6.1.6 or later. Until that upgrade is in place, disable or tightly restrict comments on weblogs and limit who can open the comment management page, because an anonymous comment with a crafted author URL can run script in a moderator or global administrator session when that page is viewed.