{"id":"CVE-2026-118405","kind":"vulnerability","aliases":["CVE-2026-118405"],"related":[],"title":"Apache Roller: user search leaks other users' email addresses to logged-in users","description":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.","summary":"Apache Roller's user search matched typed text against email addresses even though results showed only user names. Any logged-in user can therefore confirm other users' email addresses one character at a time.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["no-user-accounts","version-6.1.7-or-later"],"how_to_check":"- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.\n- Look at the Roller version in the deployment's WAR or lib directory, e.g. `ls WEB-INF/lib | grep -i roller` in the unpacked webapp.","fix":"- Apache Roller: upgrade to `6.1.7` or later, which matches only user names for non-administrator users.","status":"open","published_at":"2026-11-11T13:17:15+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:53+00:00","updated_at":"2026-11-11T13:29:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later, which matches only user names for non-administrator users.","reach":"internet","title":"Apache Roller: user search leaks other users' email addresses to logged-in users","impact":"low","summary":"Apache Roller's user search matched typed text against email addresses even though results showed only user names. Any logged-in user can therefore confirm other users' email addresses one character at a time.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","self-hosted","java"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Logged-in users can learn other users' email addresses.","analyst_note":"","how_to_check":"- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.\n- Look at the Roller version in the deployment's WAR or lib directory, e.g. `ls WEB-INF/lib | grep -i roller` in the unpacked webapp.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.1.7-or-later","no-user-accounts"],"who_is_affected":"Sites running Apache Roller from 4.0 through 6.1.6 where users can log in to the authoring interface. Exposure is limited to users who can search for other users in that interface, so instances with only trusted or no public accounts carry less risk. Instances already on 6.1.7 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4617,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118405':17A,20A '-2026':16A,19A '4.0':75C '6.1.6':77C '6.1.7':131C 'actor':71C 'address':9A,39B,58B,89C,110C,117C 'administr':144C 'allow':78C 'also':103C 'apach':1A,22B,29B,73C,129C 'apache-rol':21B 'author':95C 'charact':60B,119C 'confirm':54B,115C 'could':114C 'cve':15A,18A 'email':8A,38B,57B,88C,109C 'even':40B 'exposur':64C 'host':28B 'inform':67C 'interfac':96C 'java':24B 'later':133C 'leak':5A 'learn':85C 'log':12A,49B,81C 'logged-in':11A,48B,80C 'match':34B,104C,135C 'name':46B,100C,138C 'one':59B,118C 'packag':25B 'recommend':125C 'result':42B 'roller':2A,23B,30B,74C,130C 'search':4A,33B,92C,106C 'self':27B 'self-host':26B 'sensit':66C 'show':43B,97C 'text':36B,107C 'therefor':53B 'though':41B 'time':63B,122C 'type':35B 'unauthor':70C 'upgrad':127C 'user':3A,7A,14A,32B,45B,51B,56B,83C,87C,91C,99C,113C,123C,137C,140C","nicknames":[],"mitigations":[],"who_affected":"Sites running Apache Roller from 4.0 through 6.1.6 where users can log in to the authoring interface. Exposure is limited to users who can search for other users in that interface, so instances with only trusted or no public accounts carry less risk. Instances already on 6.1.7 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-118405':17A,20A '-2026':16A,19A 'address':9A 'apach':1A 'cve':15A,18A 'email':8A 'leak':5A 'log':12A 'logged-in':11A 'roller':2A 'search':4A 'user':3A,7A,14A","search_b":"'address':39B,58B 'apach':22B,29B 'apache-rol':21B 'charact':60B 'confirm':54B 'email':38B,57B 'even':40B 'host':28B 'java':24B 'log':49B 'logged-in':48B 'match':34B 'name':46B 'one':59B 'packag':25B 'result':42B 'roller':23B,30B 'search':33B 'self':27B 'self-host':26B 'show':43B 'text':36B 'therefor':53B 'though':41B 'time':63B 'type':35B 'user':32B,45B,51B,56B","search_c":"'4.0':75C '6.1.6':77C '6.1.7':131C 'actor':71C 'address':89C,110C,117C 'administr':144C 'allow':78C 'also':103C 'apach':73C,129C 'author':95C 'charact':119C 'confirm':115C 'could':114C 'email':88C,109C 'exposur':64C 'inform':67C 'interfac':96C 'later':133C 'learn':85C 'log':81C 'logged-in':80C 'match':104C,135C 'name':100C,138C 'one':118C 'recommend':125C 'roller':74C,130C 'search':92C,106C 'sensit':66C 'show':97C 'text':107C 'time':122C 'unauthor':70C 'upgrad':127C 'user':83C,87C,91C,99C,113C,123C,137C,140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118405","severity":null,"published_at":"2026-11-11T13:17:15+00:00","modified_at":"2026-11-11T13:17:15+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}