CVE-2026-118408 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller's entry preview checks only that a user is logged in, not that the user has a role in the weblog being previewed. A logged-in user who knows a weblog name and entry link name can read that weblog's unpublished entries.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Roller 4.0 through 6.1.6 with multiple user accounts on shared weblogs are exposed, since the attacker must already have a login. The attacker also needs the weblog name and the entry's link name. Single-user installations or ones where all logged-in users already have access to every weblog have little to lose.
Not affected if auth-required, single-user-blog
Who cares apache-roller, java, self-hosted
6.1.7 or later, which requires a role in the weblog to preview its entries.Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.