{"id":"CVE-2026-118408","kind":"vulnerability","aliases":["CVE-2026-118408"],"related":[],"title":"Apache Roller: logged-in users can read unpublished blog entries they lack access to","description":"Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.","summary":"Apache Roller's entry preview checks only that a user is logged in, not that the user has a role in the weblog being previewed. A logged-in user who knows a weblog name and entry link name can read that weblog's unpublished entries.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["auth-required","single-user-blog"],"how_to_check":"- Check the installed Apache Roller version; versions 4.0 through 6.1.6 are affected.","fix":"- Upgrade Apache Roller to `6.1.7` or later, which requires a role in the weblog to preview its entries.","status":"open","published_at":"2026-11-11T13:17:15+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:59+00:00","updated_at":"2026-11-11T13:29:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Roller to `6.1.7` or later, which requires a role in the weblog to preview its entries.","reach":"network","title":"Apache Roller: logged-in users can read unpublished blog entries they lack access to","impact":"low","summary":"Apache Roller's entry preview checks only that a user is logged in, not that the user has a role in the weblog being previewed. A logged-in user who knows a weblog name and entry link name can read that weblog's unpublished entries.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","self-hosted","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in user reads unpublished draft entries of other weblogs","analyst_note":"","how_to_check":"- Check the installed Apache Roller version; versions 4.0 through 6.1.6 are affected.\n- Unknown whether other checks apply; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","single-user-blog"],"who_is_affected":"Teams running Apache Roller 4.0 through 6.1.6 with multiple user accounts on shared weblogs are exposed, since the attacker must already have a login. The attacker also needs the weblog name and the entry's link name. Single-user installations or ones where all logged-in users already have access to every weblog have little to lose.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000724,"input_tokens":4612,"output_tokens":525,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118408':17A,20A '-2026':16A,19A '4.0':80C '6.1.6':82C '6.1.7':145C 'access':14A 'allow':83C 'apach':1A,22B,29B,78C,143C 'apache-rol':21B 'attack':125C 'author':76C 'blog':10A 'check':34B,104C 'cve':15A,18A 'entri':11A,32B,65B,74B,92C,102C,133C,158C 'host':28B 'java':24B 'know':60B,127C 'lack':13A 'later':147C 'link':66B,135C 'log':4A,40B,56B,86C,109C 'logged-in':3A,55B,85C 'miss':75C 'must':126C 'name':63B,67B,130C,136C 'packag':25B 'preview':33B,53B,103C,123C,156C 'read':8A,69B,90C 'recommend':139C 'requir':149C 'role':48B,99C,118C,151C 'roller':2A,23B,30B,79C,144C 'self':27B 'self-host':26B 'unpublish':9A,73B,91C 'upgrad':141C 'user':6A,38B,45B,58B,88C,107C,115C,137C 'weblog':51B,62B,71B,95C,121C,129C,154C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Roller 4.0 through 6.1.6 with multiple user accounts on shared weblogs are exposed, since the attacker must already have a login. The attacker also needs the weblog name and the entry's link name. Single-user installations or ones where all logged-in users already have access to every weblog have little to lose.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","low","package","selfhosted"],"campaign_type":null,"search_a":"'-118408':17A,20A '-2026':16A,19A 'access':14A 'apach':1A 'blog':10A 'cve':15A,18A 'entri':11A 'lack':13A 'log':4A 'logged-in':3A 'read':8A 'roller':2A 'unpublish':9A 'user':6A","search_b":"'apach':22B,29B 'apache-rol':21B 'check':34B 'entri':32B,65B,74B 'host':28B 'java':24B 'know':60B 'link':66B 'log':40B,56B 'logged-in':55B 'name':63B,67B 'packag':25B 'preview':33B,53B 'read':69B 'role':48B 'roller':23B,30B 'self':27B 'self-host':26B 'unpublish':73B 'user':38B,45B,58B 'weblog':51B,62B,71B","search_c":"'4.0':80C '6.1.6':82C '6.1.7':145C 'allow':83C 'apach':78C,143C 'attack':125C 'author':76C 'check':104C 'entri':92C,102C,133C,158C 'know':127C 'later':147C 'link':135C 'log':86C,109C 'logged-in':85C 'miss':75C 'must':126C 'name':130C,136C 'preview':103C,123C,156C 'read':90C 'recommend':139C 'requir':149C 'role':99C,118C,151C 'roller':79C,144C 'unpublish':91C 'upgrad':141C 'user':88C,107C,115C,137C 'weblog':95C,121C,129C,154C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118408","severity":null,"published_at":"2026-11-11T13:17:15+00:00","modified_at":"2026-11-11T13:17:15+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}