CVE-2026-118405 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller's user search matched typed text against email addresses even though results showed only user names. Any logged-in user can therefore confirm other users' email addresses one character at a time.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Apache Roller from 4.0 through 6.1.6 where users can log in to the authoring interface. Exposure is limited to users who can search for other users in that interface, so instances with only trusted or no public accounts carry less risk. Instances already on 6.1.7 or later are not affected.
Not affected if no-user-accounts, version-6.1.7-or-later
Who cares apache-roller, java, self-hosted
ls WEB-INF/lib | grep -i roller in the unpacked webapp.6.1.7 or later, which matches only user names for non-administrator users.Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.