---
id: "CVE-2026-118409"
page: "https://infrastack.ai/live/CVE-2026-118409"
kind: "vulnerability"
aliases: ["CVE-2026-118409"]
title: "Apache Roller: public search leaks commenters' email addresses to visitors"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-roller", "blogging", "java", "runtime", "self-hosted"]
not_affected_if: ["no-comments", "no-public-search", "version-6.1.7-or-later"]
published_at: "2026-11-11T13:17:16+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118409", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Apache Roller: public search leaks commenters' email addresses to visitors

Link for people: https://infrastack.ai/live/CVE-2026-118409 (this .md is for agents)

Apache Roller 4.0 through 6.1.6 stored commenter email addresses in its search index, and public weblog search could query that field. An unauthenticated visitor can recover the email addresses of people who left approved comments, including by wildcard queries that confirm an address one character at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Roller version against the affected range 4.0 through 6.1.6.
- Confirm whether public weblog search is enabled on the weblog.
- Check whether the search index was built on a version that stored commenter email addresses.

## Fix

- Upgrade Apache Roller to `6.1.7` or later.
- Rebuild the search index after upgrading.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118409

## From the sources

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_