---
id: "CVE-2026-105152"
page: "https://infrastack.ai/live/CVE-2026-105152"
kind: "vulnerability"
aliases: ["CVE-2026-105152"]
title: "Apache Roller: weblog admins can read other users' password hashes via templates"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["no-template-authors", "roller-6.1.7-or-later"]
published_at: "2026-11-11T13:17:12+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105152", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: weblog admins can read other users' password hashes via templates

Link for people: https://infrastack.ai/live/CVE-2026-105152 (this .md is for agents)

Apache Roller 4.0 through 6.1.6 lets a weblog administrator author a template that exposes the underlying persistent objects behind weblog and entry data. An attacker can read the stored password hash of the weblog's creator and of authors whose entries render on the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Roller version in use; versions `4.0` through `6.1.6` are affected.
- Review which accounts can author custom weblog templates.

## Fix

- Upgrade Apache Roller to `6.1.7` or later.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105152

## From the sources

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_