APACHE ROLLER · CVE-2026-118411 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller accepts state-changing admin actions over GET without a valid request token, so a crafted link can make a logged-in administrator create a new admin account. An attacker who gets that account gains full control of the blogging server.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Roller between 5.0.1 and 6.1.6 where administrators use the web admin interface in the same browser they use for general browsing. Exposure depends on an administrator being logged in and opening an attacker-supplied link, so deployments with no admin logins or with strict browser separation carry less risk.
Not affected if no-admin-browsing, version-6.1.7-or-later
Who cares apache-roller, java, self-hosted
WEB-INF/lib or release files; affected range is 5.0.1 through 6.1.6.6.1.7 or later, which requires POST and a valid token for data-changing actions.Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.