CVE-2026-122300 · Package
NO FIX YET · SEE WHAT TO DO
Apache Roller 4.0 through 6.1.6 fails to check whether a member's role allows changes when editing a weblog entry. A weblog member with the Limited role can remove or change entries they may only read, including entries published by other members.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Apache Roller multi-user blogs where some members hold the Limited role. The flaw lets such a member edit or delete entries they should only read, including other members' entries. Single-author installs or instances without Limited-role members are less exposed.
Not affected if no-limited-role-members, single-author
Who cares apache-roller, java, self-hosted
4.0 through 6.1.66.1.7 or laterMissing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.