CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
Apache Roller 6.1.5 lets one weblog's authors tamper with another weblog's resources.
Apache disclosed CVE-2026-82348 in Apache Roller 6.1.5. An authorization bypass through a user-controlled key lets an authenticated user with authoring rights on one weblog read, modify, or delete resources belonging to another weblog via unscoped identifier lookups. The issue affects multi-user installations where users author separate weblogs. CVSS 3.1 is 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L), and the project rated it important. No exploitation in the wild is reported.
- CVE-2026-82348 is an authorization bypass in Apache Roller 6.1.5.
- Authors can read, modify, or delete another weblog's resources.
- Lookups use unscoped, user-controlled identifiers.
- It matters on multi-user installations with separate weblog authors.
- CVSS 3.1 is 7.7; exploitation is not reported.
- CVEs
- CVE-2026-82348
- Vendors
- Apache Software Foundation
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82348 | Cross-weblog authorization bypass in Apache Roller 6.1.5 | 7.7 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Important CVSS 3. 1: 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.