{"id":"CVE-2026-118410","kind":"vulnerability","aliases":["CVE-2026-118410"],"related":[],"title":"Apache Roller: withdrawn blog entries stay visible in public search","description":"Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.","summary":"Apache Roller keeps a blog entry in its search index after the author moves it back to draft through the AtomPub API. An unauthenticated visitor can then read the withdrawn content through public search.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","blogging","package","self-hosted"],"not_affected_if":["atompub-disabled","default-config"],"how_to_check":"- Check the Apache Roller version in use; affected releases are 4.0 through 6.1.6.\n- Check whether AtomPub is enabled on the weblog server; it is disabled by default.","fix":"- Upgrade Apache Roller to `6.1.7` or later.","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:55+00:00","updated_at":"2026-11-11T13:29:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Roller to `6.1.7` or later.","reach":"internet","title":"Apache Roller: withdrawn blog entries stay visible in public search","impact":"low","summary":"Apache Roller keeps a blog entry in its search index after the author moves it back to draft through the AtomPub API. An unauthenticated visitor can then read the withdrawn content through public search.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","self-hosted","blogging"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unpublished blog content readable by anyone through search","analyst_note":"","how_to_check":"- Check the Apache Roller version in use; affected releases are 4.0 through 6.1.6.\n- Check whether AtomPub is enabled on the weblog server; it is disabled by default.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","atompub-disabled"],"who_is_affected":"Sites running Apache Roller 4.0 through 6.1.6 where the AtomPub API is enabled, since withdrawn entries can remain in public search. Installations that keep AtomPub disabled, the default, are not exposed through this path according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000699,"input_tokens":4623,"output_tokens":474,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118410':13A,16A '-2026':12A,15A '4.0':68C '6.1.6':70C '6.1.7':123C 'allow':71C 'apach':1A,18B,25B,66C,121C 'apache-rol':17B 'api':46B,90C 'atompub':45B,89C,110C 'author':37B,81C 'back':40B 'blog':4A,20B,29B 'content':55B,109C 'cve':11A,14A 'default':114C 'disabl':112C 'draft':42B,86C 'entri':5A,30B,78C,92C,130C 'exposur':59C 'host':24B 'index':34B,103C 'keep':27B 'later':125C 'move':38B 'packag':21B 'public':9A,57B,105C 'publish':129C 'read':52B,76C 'recommend':117C 'remov':94C 'resourc':61C 'result':133C 'roller':2A,19B,26B,67C,122C 'search':10A,33B,58B,102C,106C,132C 'self':23B 'self-host':22B 'show':107C,127C 'sphere':64C 'stay':6A,99C 'unauthent':48B,73C 'upgrad':119C 'user':115C 'visibl':7A 'visitor':49B,74C 'weblog':97C 'withdrawn':3A,54B,83C 'wrong':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running Apache Roller 4.0 through 6.1.6 where the AtomPub API is enabled, since withdrawn entries can remain in public search. Installations that keep AtomPub disabled, the default, are not exposed through this path according to the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","blogging","low","package","selfhosted"],"campaign_type":null,"search_a":"'-118410':13A,16A '-2026':12A,15A 'apach':1A 'blog':4A 'cve':11A,14A 'entri':5A 'public':9A 'roller':2A 'search':10A 'stay':6A 'visibl':7A 'withdrawn':3A","search_b":"'apach':18B,25B 'apache-rol':17B 'api':46B 'atompub':45B 'author':37B 'back':40B 'blog':20B,29B 'content':55B 'draft':42B 'entri':30B 'host':24B 'index':34B 'keep':27B 'move':38B 'packag':21B 'public':57B 'read':52B 'roller':19B,26B 'search':33B,58B 'self':23B 'self-host':22B 'unauthent':48B 'visitor':49B 'withdrawn':54B","search_c":"'4.0':68C '6.1.6':70C '6.1.7':123C 'allow':71C 'apach':66C,121C 'api':90C 'atompub':89C,110C 'author':81C 'content':109C 'default':114C 'disabl':112C 'draft':86C 'entri':78C,92C,130C 'exposur':59C 'index':103C 'later':125C 'public':105C 'publish':129C 'read':76C 'recommend':117C 'remov':94C 'resourc':61C 'result':133C 'roller':67C,122C 'search':102C,106C,132C 'show':107C,127C 'sphere':64C 'stay':99C 'unauthent':73C 'upgrad':119C 'user':115C 'visitor':74C 'weblog':97C 'withdrawn':83C 'wrong':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118410","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}