CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Apache Roller 6.1.5 lets authenticated users read, modify, or delete other weblogs via XML-RPC.
Apache disclosed CVE-2026-82377 in Apache Roller 6.1.5. Missing authorization in the legacy XML-RPC Blogger and MetaWeblog handlers lets an authenticated user read, modify, or delete content belonging to other weblogs. The handlers authenticate the caller but do not verify permission on the target weblog. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the project labeled severity moderate. Exploitation in the wild is not reported.
- CVE-2026-82377 affects Apache Roller 6.1.5.
- Authenticated users can read, modify, or delete other weblogs.
- Legacy Blogger and MetaWeblog XML-RPC handlers skip permission checks.
- CVSS 3.1 is 9.9; the project rated it moderate.
- No in-the-wild exploitation is reported.
- CVEs
- CVE-2026-82377
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82377 | Missing authorization in Apache Roller XML-RPC APIs | 9.9 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 9.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.