{"id":"CVE-2026-118412","kind":"vulnerability","aliases":["CVE-2026-118412"],"related":[],"title":"Apache Roller: disabled accounts can sign in via OpenID and read drafts","description":"Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.","summary":"Apache Roller, a Java blogging server, did not check whether an account was disabled when signing in through OpenID. A disabled user can therefore log in again and read unpublished entries.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["default-config","openid-disabled","roller-6.1.7-or-later"],"how_to_check":"- Check whether OpenID authentication is enabled in the Roller configuration (non-default mode).\n- Confirm the installed Roller version with the deployed WAR or package version; affected range is `5.1.0` through `6.1.6`.","fix":"- Apache Roller: upgrade to `6.1.7` or later.","status":"open","published_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:57+00:00","updated_at":"2026-11-11T13:29:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later.","reach":"internet","title":"Apache Roller: disabled accounts can sign in via OpenID and read drafts","impact":"low","summary":"Apache Roller, a Java blogging server, did not check whether an account was disabled when signing in through OpenID. A disabled user can therefore log in again and read unpublished entries.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","java","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"disabled user reads unpublished blog entries via OpenID","analyst_note":"","how_to_check":"- Check whether OpenID authentication is enabled in the Roller configuration (non-default mode).\n- Confirm the installed Roller version with the deployed WAR or package version; affected range is `5.1.0` through `6.1.6`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","openid-disabled","roller-6.1.7-or-later"],"who_is_affected":"Only sites running Apache Roller 5.1.0 through 6.1.6 with the non-default OpenID authentication mode enabled are exposed. Installations using standard login, or later major versions that drop OpenID 2.0, are not affected. The risk is that a user disabled by an administrator can still read unpublished blog entries.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000724,"input_tokens":4610,"output_tokens":526,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118412':15A,18A '-2026':14A,17A '2.0':119C '5.1.0':63C '6.1.6':65C '6.1.7':128C 'account':4A,38B,70C,96C 'administr':72C 'affect':111C 'allow':66C 'apach':1A,20B,27B,61C,126C 'apache-rol':19B 'authent':59C,108C 'blog':31B 'check':35B,93C 'cve':13A,16A 'default':106C 'disabl':3A,40B,47B,74C 'draft':12A 'enabl':98C,102C 'entri':57B,84C 'host':26B 'improp':58C 'includ':117C 'java':22B,30B 'later':112C,130C 'log':51B 'major':113C 'mode':109C 'non':105C 'non-default':104C 'openid':9A,45B,80C,86C,107C,118C 'packag':23B 'path':90C 'read':11A,55B,82C 'recommend':122C 'roller':2A,21B,28B,62C,127C 'self':25B 'self-host':24B 'server':32B 'sign':6A,42B,76C,88C 'sign-in':87C 'site':100C 'therefor':50B 'unpublish':56B,83C 'upgrad':124C 'user':48B,68C,120C 'version':114C 'via':8A 'whether':36B,94C 'whose':69C","nicknames":[],"mitigations":[],"who_affected":"Only sites running Apache Roller 5.1.0 through 6.1.6 with the non-default OpenID authentication mode enabled are exposed. Installations using standard login, or later major versions that drop OpenID 2.0, are not affected. The risk is that a user disabled by an administrator can still read unpublished blog entries.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","low","package","selfhosted"],"campaign_type":null,"search_a":"'-118412':15A,18A '-2026':14A,17A 'account':4A 'apach':1A 'cve':13A,16A 'disabl':3A 'draft':12A 'openid':9A 'read':11A 'roller':2A 'sign':6A 'via':8A","search_b":"'account':38B 'apach':20B,27B 'apache-rol':19B 'blog':31B 'check':35B 'disabl':40B,47B 'entri':57B 'host':26B 'java':22B,30B 'log':51B 'openid':45B 'packag':23B 'read':55B 'roller':21B,28B 'self':25B 'self-host':24B 'server':32B 'sign':42B 'therefor':50B 'unpublish':56B 'user':48B 'whether':36B","search_c":"'2.0':119C '5.1.0':63C '6.1.6':65C '6.1.7':128C 'account':70C,96C 'administr':72C 'affect':111C 'allow':66C 'apach':61C,126C 'authent':59C,108C 'check':93C 'default':106C 'disabl':74C 'enabl':98C,102C 'entri':84C 'improp':58C 'includ':117C 'later':112C,130C 'major':113C 'mode':109C 'non':105C 'non-default':104C 'openid':80C,86C,107C,118C 'path':90C 'read':82C 'recommend':122C 'roller':62C,127C 'sign':76C,88C 'sign-in':87C 'site':100C 'unpublish':83C 'upgrad':124C 'user':68C,120C 'version':114C 'whether':94C 'whose':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118412","severity":null,"published_at":"2026-11-11T13:17:16+00:00","modified_at":"2026-11-11T13:17:16+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}