{"id":"CVE-2026-105152","kind":"vulnerability","aliases":["CVE-2026-105152"],"related":[],"title":"Apache Roller: weblog admins can read other users' password hashes via templates","description":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.","summary":"Apache Roller 4.0 through 6.1.6 lets a weblog administrator author a template that exposes the underlying persistent objects behind weblog and entry data. An attacker can read the stored password hash of the weblog's creator and of authors whose entries render on the page.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["no-template-authors","roller-6.1.7-or-later"],"how_to_check":"- Check the Apache Roller version in use; versions `4.0` through `6.1.6` are affected.\n- Review which accounts can author custom weblog templates.","fix":"- Upgrade Apache Roller to `6.1.7` or later.","status":"open","published_at":"2026-11-11T13:17:12+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:54+00:00","updated_at":"2026-11-11T13:29:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:29:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Roller to `6.1.7` or later.","reach":"network","title":"Apache Roller: weblog admins can read other users' password hashes via templates","impact":"medium","summary":"Apache Roller 4.0 through 6.1.6 lets a weblog administrator author a template that exposes the underlying persistent objects behind weblog and entry data. An attacker can read the stored password hash of the weblog's creator and of authors whose entries render on the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","self-hosted","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other users' stored password hashes from templates","analyst_note":"","how_to_check":"- Check the Apache Roller version in use; versions `4.0` through `6.1.6` are affected.\n- Review which accounts can author custom weblog templates.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["roller-6.1.7-or-later","no-template-authors"],"who_is_affected":"Any Apache Roller installation from 4.0 through 6.1.6 where a weblog administrator can author templates is exposed. The sources do not say whether managed or hosted Roller deployments are handled differently. Instances where only trusted operators can edit templates carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4755,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105152':15A,18A '-2026':14A,17A '4.0':29B,83C '6.1.6':31B,85C '6.1.7':207C 'access':213C 'accessor':152C 'actor':79C 'admin':4A 'administr':35B,89C,134C,195C 'affect':191C 'allow':86C 'anoth':92C 'apach':1A,20B,27B,81C,205C 'apache-rol':19B 'attack':51B 'author':36B,65B,99C,176C,197C 'behind':45B,110C 'class':148C,156C 'configur':187C 'creator':62B,172C 'custom':101C 'cve':13A,16A 'data':49B,117C,142C 'default':186C 'direct':162C 'entri':48B,67B,116C,141C,178C 'expos':40B,130C,138C 'exposur':72C 'field':124C 'hash':10A,57B,97C,167C 'host':26B 'includ':163C 'inform':75C 'java':22B 'later':209C 'let':32B 'meant':128C 'non':185C 'non-default':184C 'object':44B,109C,161C,218C 'packag':23B 'page':71B,182C 'password':9A,56B,96C,166C 'persist':43B,108C,160C 'public':151C 'rather':118C 'reach':105C 'read':6A,53B,91C 'recommend':201C 'reduc':121C 'remov':211C 'render':68B,179C 'requir':189C 'return':157C 'roller':2A,21B,28B,82C,131C,206C 'self':25B 'self-host':24B 'sensit':74C 'set':122C 'store':55B,95C,165C 'templat':12A,38B,103C,112C,144C,198C,212C 'treat':132C 'unauthor':78C 'under':42B,159C,216C 'untrust':136C 'upgrad':203C 'user':8A,93C,199C 'via':11A 'weblog':3A,34B,46B,60B,88C,102C,114C,133C,139C,170C,193C 'whose':66B,177C,194C 'wrap':107C,217C 'wrapper':126C,147C,155C","nicknames":[],"mitigations":[],"who_affected":"Any Apache Roller installation from 4.0 through 6.1.6 where a weblog administrator can author templates is exposed. The sources do not say whether managed or hosted Roller deployments are handled differently. Instances where only trusted operators can edit templates carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-105152':15A,18A '-2026':14A,17A 'admin':4A 'apach':1A 'cve':13A,16A 'hash':10A 'password':9A 'read':6A 'roller':2A 'templat':12A 'user':8A 'via':11A 'weblog':3A","search_b":"'4.0':29B '6.1.6':31B 'administr':35B 'apach':20B,27B 'apache-rol':19B 'attack':51B 'author':36B,65B 'behind':45B 'creator':62B 'data':49B 'entri':48B,67B 'expos':40B 'hash':57B 'host':26B 'java':22B 'let':32B 'object':44B 'packag':23B 'page':71B 'password':56B 'persist':43B 'read':53B 'render':68B 'roller':21B,28B 'self':25B 'self-host':24B 'store':55B 'templat':38B 'under':42B 'weblog':34B,46B,60B 'whose':66B","search_c":"'4.0':83C '6.1.6':85C '6.1.7':207C 'access':213C 'accessor':152C 'actor':79C 'administr':89C,134C,195C 'affect':191C 'allow':86C 'anoth':92C 'apach':81C,205C 'author':99C,176C,197C 'behind':110C 'class':148C,156C 'configur':187C 'creator':172C 'custom':101C 'data':117C,142C 'default':186C 'direct':162C 'entri':116C,141C,178C 'expos':130C,138C 'exposur':72C 'field':124C 'hash':97C,167C 'includ':163C 'inform':75C 'later':209C 'meant':128C 'non':185C 'non-default':184C 'object':109C,161C,218C 'page':182C 'password':96C,166C 'persist':108C,160C 'public':151C 'rather':118C 'reach':105C 'read':91C 'recommend':201C 'reduc':121C 'remov':211C 'render':179C 'requir':189C 'return':157C 'roller':82C,131C,206C 'sensit':74C 'set':122C 'store':95C,165C 'templat':103C,112C,144C,198C,212C 'treat':132C 'unauthor':78C 'under':159C,216C 'untrust':136C 'upgrad':203C 'user':93C,199C 'weblog':88C,102C,114C,133C,139C,170C,193C 'whose':177C,194C 'wrap':107C,217C 'wrapper':126C,147C,155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105152","severity":null,"published_at":"2026-11-11T13:17:12+00:00","modified_at":"2026-11-11T13:17:12+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}