CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL
Apache Roller 6.1.5 stored XSS can run in moderator or administrator sessions via comment-author URLs.
CVE-2026-86507 is a stored XSS flaw in Apache Roller 6.1.5 comment moderation. An anonymous attacker can store a crafted comment-author URL that executes script when a weblog moderator or global administrator views the comment management page. Apache calls the issue Important, though the published CVSS 3.1 vector is 6.1 (medium) and requires user interaction. It affects sites that allow the vulnerable comment behavior; exploitation is not reported as observed.
- Stored XSS via the comment-author URL field.
- Script runs in a weblog moderator or global administrator session.
- Apache labels it Important; CVSS 3.1 is still 6.1.
- Only sites that permit the affected comment feature are impacted.
- CVEs
- CVE-2026-86507
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86507 | Stored XSS in Apache Roller comment moderation | 6.1 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.