CVE-2026-118412 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller, a Java blogging server, did not check whether an account was disabled when signing in through OpenID. A disabled user can therefore log in again and read unpublished entries.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only sites running Apache Roller 5.1.0 through 6.1.6 with the non-default OpenID authentication mode enabled are exposed. Installations using standard login, or later major versions that drop OpenID 2.0, are not affected. The risk is that a user disabled by an administrator can still read unpublished blog entries.
Not affected if default-config, openid-disabled, roller-6.1.7-or-later
Who cares apache-roller, java, self-hosted
5.1.0 through 6.1.6.6.1.7 or later.Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.