CVE-2026-91206

Apache Roller 6.1.5 has a reflected cross-site scripting flaw (CWE-79) in the optional LDAP comment authenticator. The authenticator writes request parameter values into its HTML form without escaping, so a remote attacker can supply a crafted link that reflects those values into the page. The attack works only on sites configured to use LdapCommentAuthenticator, and only if a victim whose session has already loaded the authenticator form follows the link; the impact is limited confidentiality and integrity in the victim's browser (CVSS 3.1 6.1, scope changed). Sites that do not use this authenticator are not affected. No public proof of concept is known, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade Apache Roller to 6.1.6 or later, which escapes the reflected parameter values. Until you can upgrade, disable LdapCommentAuthenticator if LDAP comment authentication is not required, and treat unsolicited links to that form as untrusted. Confirm whether the deployment actually uses this optional authenticator, because sites that do not are unaffected.