CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering
Apache Roller 6.1.5 lets unauthenticated attackers persistently change the site frontpage weblog selection.
Apache disclosed CVE-2026-82383 in Apache Roller 6.1.5, rated Important with CVSS 3.1 8.2. Missing authentication lets an unauthenticated remote attacker persistently change the site-global frontpage weblog selection because the setup action remains reachable after installation. Impact is high integrity and low availability, with no confidentiality loss. The advisory does not report exploitation in the wild.
- CVE-2026-82383 affects Apache Roller 6.1.5 only.
- Unauthenticated attackers can change the global frontpage weblog selection.
- CVSS 3.1 is 8.2: high integrity, low availability, no confidentiality impact.
- The setup action remains anonymously reachable after installation.
- CVEs
- CVE-2026-82383
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82383 | Missing authentication lets attackers change Apache Roller frontpage | 8.2 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 8.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.