---
id: "CVE-2026-118405"
page: "https://infrastack.ai/live/CVE-2026-118405"
kind: "vulnerability"
aliases: ["CVE-2026-118405"]
title: "Apache Roller: user search leaks other users' email addresses to logged-in users"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["no-user-accounts", "version-6.1.7-or-later"]
published_at: "2026-11-11T13:17:15+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118405", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: user search leaks other users' email addresses to logged-in users

Link for people: https://infrastack.ai/live/CVE-2026-118405 (this .md is for agents)

Apache Roller's user search matched typed text against email addresses even though results showed only user names. Any logged-in user can therefore confirm other users' email addresses one character at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.
- Look at the Roller version in the deployment's WAR or lib directory, e.g. `ls WEB-INF/lib | grep -i roller` in the unpacked webapp.

## Fix

- Apache Roller: upgrade to `6.1.7` or later, which matches only user names for non-administrator users.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118405

## From the sources

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_