---
id: "CVE-2026-118408"
page: "https://infrastack.ai/live/CVE-2026-118408"
kind: "vulnerability"
aliases: ["CVE-2026-118408"]
title: "Apache Roller: logged-in users can read unpublished blog entries they lack access to"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["auth-required", "single-user-blog"]
published_at: "2026-11-11T13:17:15+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118408", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: logged-in users can read unpublished blog entries they lack access to

Link for people: https://infrastack.ai/live/CVE-2026-118408 (this .md is for agents)

Apache Roller's entry preview checks only that a user is logged in, not that the user has a role in the weblog being previewed. A logged-in user who knows a weblog name and entry link name can read that weblog's unpublished entries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Roller version; versions 4.0 through 6.1.6 are affected.

## Fix

- Upgrade Apache Roller to `6.1.7` or later, which requires a role in the weblog to preview its entries.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118408

## From the sources

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_