{"id":"CVE-2026-118409","kind":"vulnerability","aliases":["CVE-2026-118409"],"related":[],"title":"Apache Roller: public search leaks commenters' email addresses to visitors","description":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.","summary":"Apache Roller 4.0 through 6.1.6 stored commenter email addresses in its search index, and public weblog search could query that field. An unauthenticated visitor can recover the email addresses of people who left approved comments, including by wildcard queries that confirm an address one character at a time.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","blogging","java","runtime","self-hosted"],"not_affected_if":["no-comments","no-public-search","version-6.1.7-or-later"],"how_to_check":"- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.\n- Confirm whether public weblog search is enabled on the weblog.\n- Check whether the search index was built on a version that stored commenter email addresses.","fix":"- Upgrade Apache Roller to `6.1.7` or later.\n- Rebuild the search index after upgrading.","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:44+00:00","updated_at":"2026-11-11T13:29:44+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T13:29:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Roller to `6.1.7` or later.\n- Rebuild the search index after upgrading.","reach":"internet","title":"Apache Roller: public search leaks commenters' email addresses to visitors","impact":"medium","summary":"Apache Roller 4.0 through 6.1.6 stored commenter email addresses in its search index, and public weblog search could query that field. An unauthenticated visitor can recover the email addresses of people who left approved comments, including by wildcard queries that confirm an address one character at a time.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-roller","java","self-hosted","blogging"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Commenter email addresses are recovered by unauthenticated visitors.","analyst_note":"","how_to_check":"- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.\n- Confirm whether public weblog search is enabled on the weblog.\n- Check whether the search index was built on a version that stored commenter email addresses.","plain_action":"","product_name":"apache-roller","needs_analyst":false,"not_affected_if":["version-6.1.7-or-later","no-public-search","no-comments"],"who_is_affected":"Sites running Apache Roller 4.0 through 6.1.6 with a public weblog that has approved comments and public search. The exposure comes from the search index, which holds commenter emails and answers public queries. Installations without comments or without public search are not exposed by this description.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4619,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118409':13A,16A '-2026':12A,15A '4.0':28B,85C '6.1.6':30B,87C '6.1.7':140C 'accept':115C 'actor':81C 'address':8A,34B,54B,68B,96C,109C,126C 'allow':88C 'apach':1A,18B,26B,83C,138C 'apache-rol':17B 'approv':59B,101C 'blog':20B 'charact':70B,128C 'comment':6A,32B,60B,102C,107C 'confirm':66B,124C 'could':43B 'cve':11A,14A 'email':7A,33B,53B,95C,108C 'exposur':74C 'field':46B,119C 'host':25B 'includ':61B,120C 'index':38B,105C,147C 'inform':77C 'java':21B 'later':142C 'leak':5A 'left':58B,100C 'one':69B,127C 'peopl':56B,98C 'public':3A,40B,112C 'queri':44B,64B,116C,122C 'rebuild':144C 'recommend':134C 'recov':51B,93C 'roller':2A,19B,27B,84C,139C 'runtim':22B 'search':4A,37B,42B,104C,114C,146C 'self':24B 'self-host':23B 'sensit':76C 'store':31B,106C 'time':73B,131C 'unauthent':48B,90C 'unauthor':80C 'upgrad':136C 'user':132C 'visitor':10A,49B,91C 'weblog':41B,113C 'wildcard':63B,121C","nicknames":[],"mitigations":[],"who_affected":"Sites running Apache Roller 4.0 through 6.1.6 with a public weblog that has approved comments and public search. The exposure comes from the search index, which holds commenter emails and answers public queries. Installations without comments or without public search are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","blogging","java","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-118409':13A,16A '-2026':12A,15A 'address':8A 'apach':1A 'comment':6A 'cve':11A,14A 'email':7A 'leak':5A 'public':3A 'roller':2A 'search':4A 'visitor':10A","search_b":"'4.0':28B '6.1.6':30B 'address':34B,54B,68B 'apach':18B,26B 'apache-rol':17B 'approv':59B 'blog':20B 'charact':70B 'comment':32B,60B 'confirm':66B 'could':43B 'email':33B,53B 'field':46B 'host':25B 'includ':61B 'index':38B 'java':21B 'left':58B 'one':69B 'peopl':56B 'public':40B 'queri':44B,64B 'recov':51B 'roller':19B,27B 'runtim':22B 'search':37B,42B 'self':24B 'self-host':23B 'store':31B 'time':73B 'unauthent':48B 'visitor':49B 'weblog':41B 'wildcard':63B","search_c":"'4.0':85C '6.1.6':87C '6.1.7':140C 'accept':115C 'actor':81C 'address':96C,109C,126C 'allow':88C 'apach':83C,138C 'approv':101C 'charact':128C 'comment':102C,107C 'confirm':124C 'email':95C,108C 'exposur':74C 'field':119C 'includ':120C 'index':105C,147C 'inform':77C 'later':142C 'left':100C 'one':127C 'peopl':98C 'public':112C 'queri':116C,122C 'rebuild':144C 'recommend':134C 'recov':93C 'roller':84C,139C 'search':104C,114C,146C 'sensit':76C 'store':106C 'time':131C 'unauthent':90C 'unauthor':80C 'upgrad':136C 'user':132C 'visitor':91C 'weblog':113C 'wildcard':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118409","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}