Apache discloses ten vulnerabilities in Roller 6.1.5, led by XML-RPC flaws rated CVSS 9.9 and 9.8

On 25 September 2026 Apache disclosed ten flaws in Apache Roller 6.1.5, including unauthenticated deserialization in the XML-RPC endpoint (CVSS 3.1 9.8) and missing weblog permission checks in legacy XML-RPC handlers (9.9); no in-the-wild exploitation is…

On 25 September 2026, Apache disclosed ten vulnerabilities in Apache Roller 6.1.5, the only version listed as affected, and none of the advisories reports exploitation in the wild. The highest CVSS 3.1 score belongs to CVE-2026-82377 (9.9; AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): the legacy XML-RPC Blogger and MetaWeblog handlers authenticate the caller but never verify permission on the target weblog, so any authenticated user can read, modify, or delete other weblogs' content — although the project itself rated this issue moderate. CVE-2026-82384 (9.8, rated critical) is unauthenticated deserialization in the same XML-RPC endpoint: vendor extension types are deserialized while parsing a request, before authentication, with high confidentiality, integrity, and availability impact. CVE-2026-82378 (9.0, project label Moderate) lets an unauthenticated remote attacker who learns an outstanding OAuth 1.0a request token for a configured site-wide consumer bind it to any account, including an administrator; the attack is high-complexity and requires a live request token. Two further Important flaws are unauthenticated: CVE-2026-82383 (8.2) leaves the setup action reachable after installation, allowing persistent changes to the site-global frontpage weblog selection, and CVE-2026-82380 (8.1) is a CSRF bypass in which filters accept requests that omit the required salt token, letting a remote attacker forge state-changing actions by a logged-in user. The remaining issues require privileges: authenticated authors on one weblog can read, modify, or delete another weblog's resources via unscoped, user-controlled identifier lookups on multi-user installations (CVE-2026-82348, 7.7, important); users with entry-editing rights can trigger SSRF through legacy trackback and enclosure URLs, with the standard Trackback control hidden in the interface (CVE-2026-82375, 7.4, moderate) or cause file disclosure via XXE in the trackback response parser (CVE-2026-82376, 7.7, important). Weblog administrators can escape the Velocity sandbox through a template include directive to read classpath configuration files including secrets (CVE-2026-82385, 6.5) or import a crafted OPML document whose parser leaves external entities enabled, reading process-readable files and reaching internal network addresses (CVE-2026-82386, 7.7, important).

• Ten CVEs disclosed 2026-09-25 against Apache Roller 6.1.5; it is the only affected version listed.