{"id":"CVE-2026-118411","kind":"vulnerability","aliases":["CVE-2026-118411"],"related":[],"title":"Apache Roller: CSRF lets a link create an administrator account","description":"Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.","summary":"Apache Roller accepts state-changing admin actions over GET without a valid request token, so a crafted link can make a logged-in administrator create a new admin account. An attacker who gets that account gains full control of the blogging server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Roller","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["no-admin-browsing","version-6.1.7-or-later"],"how_to_check":"- Check the installed Apache Roller version in the deployed `WEB-INF/lib` or release files; affected range is `5.0.1` through `6.1.6`.\n- Review the admin user list for accounts created recently that no one on the team recognises.","fix":"- Apache Roller: upgrade to `6.1.7` or later, which requires POST and a valid token for data-changing actions.","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:08+00:00","updated_at":"2026-11-11T13:29:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later, which requires POST and a valid token for data-changing actions.","reach":"internet","title":"Apache Roller: CSRF lets a link create an administrator account","impact":"high","summary":"Apache Roller accepts state-changing admin actions over GET without a valid request token, so a crafted link can make a logged-in administrator create a new admin account. An attacker who gets that account gains full control of the blogging server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","java","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker creates an administrator account on the blog server","analyst_note":"","how_to_check":"- Check the installed Apache Roller version in the deployed `WEB-INF/lib` or release files; affected range is `5.0.1` through `6.1.6`.\n- Review the admin user list for accounts created recently that no one on the team recognises.","plain_action":"","product_name":"Apache Roller","needs_analyst":false,"not_affected_if":["version-6.1.7-or-later","no-admin-browsing"],"who_is_affected":"Teams running Apache Roller between 5.0.1 and 6.1.6 where administrators use the web admin interface in the same browser they use for general browsing. Exposure depends on an administrator being logged in and opening an attacker-supplied link, so deployments with no admin logins or with strict browser separation carry less risk.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4627,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118411':13A,16A '-2026':12A,15A '5.0.1':80C '6.1.6':82C '6.1.7':131C 'accept':29B,120C 'account':10A,57B,63B,91C 'action':34B,118C,142C 'admin':33B,56B 'administr':9A,52B,90C,98C,117C 'allow':83C 'also':119C 'apach':1A,20B,27B,78C,129C 'apache':17A 'apache-rol':19B 'appli':111C 'attack':59B,86C,104C 'blog':69B 'chang':32B,144C 'check':110C 'control':66B,105C 'craft':44B 'creat':7A,53B,88C 'cross':72C 'cross-sit':71C 'csrf':3A,76C 'cve':11A,14A 'data':145C 'forgeri':75C 'full':65B 'gain':64B 'get':36B,61B,121C 'host':26B 'java':22B 'later':133C 'let':4A 'link':6A,45B,101C 'log':50B,95C 'logged-in':49B,94C 'make':47B 'new':55B 'open':99C 'packag':23B 'post':114C,136C 'recommend':125C 'request':40B,74C,108C,115C,122C 'request-token':107C 'requir':135C 'roller':2A,18A,21B,28B,79C,97C,130C 'self':25B 'self-host':24B 'server':70B 'site':73C 'state':31B 'state-chang':30B 'token':41B,109C,140C 'unauthent':85C 'upgrad':127C 'user':123C 'valid':39B,139C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Roller between 5.0.1 and 6.1.6 where administrators use the web admin interface in the same browser they use for general browsing. Exposure depends on an administrator being logged in and opening an attacker-supplied link, so deployments with no admin logins or with strict browser separation carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheroller","roller"],"ptokens":["apache","roller"],"labels":["apacheroller","high","java","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118411':13A,16A '-2026':12A,15A 'account':10A 'administr':9A 'apach':1A 'apache':17A 'creat':7A 'csrf':3A 'cve':11A,14A 'let':4A 'link':6A 'roller':2A,18A","search_b":"'accept':29B 'account':57B,63B 'action':34B 'admin':33B,56B 'administr':52B 'apach':20B,27B 'apache-rol':19B 'attack':59B 'blog':69B 'chang':32B 'control':66B 'craft':44B 'creat':53B 'full':65B 'gain':64B 'get':36B,61B 'host':26B 'java':22B 'link':45B 'log':50B 'logged-in':49B 'make':47B 'new':55B 'packag':23B 'request':40B 'roller':21B,28B 'self':25B 'self-host':24B 'server':70B 'state':31B 'state-chang':30B 'token':41B 'valid':39B 'without':37B","search_c":"'5.0.1':80C '6.1.6':82C '6.1.7':131C 'accept':120C 'account':91C 'action':118C,142C 'administr':90C,98C,117C 'allow':83C 'also':119C 'apach':78C,129C 'appli':111C 'attack':86C,104C 'chang':144C 'check':110C 'control':105C 'creat':88C 'cross':72C 'cross-sit':71C 'csrf':76C 'data':145C 'forgeri':75C 'get':121C 'later':133C 'link':101C 'log':95C 'logged-in':94C 'open':99C 'post':114C,136C 'recommend':125C 'request':74C,108C,115C,122C 'request-token':107C 'requir':135C 'roller':79C,97C,130C 'site':73C 'token':109C,140C 'unauthent':85C 'upgrad':127C 'user':123C 'valid':139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118411","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}