{"id":"CVE-2026-122300","kind":"vulnerability","aliases":["CVE-2026-122300"],"related":[],"title":"Apache Roller: Limited-role members can alter entries they may only read","description":"Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.\nUsers are recommended to upgrade to Apache Roller 6.1.7 or later.","summary":"Apache Roller 4.0 through 6.1.6 fails to check whether a member's role allows changes when editing a weblog entry. A weblog member with the Limited role can remove or change entries they may only read, including entries published by other members.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","package","self-hosted"],"not_affected_if":["no-limited-role-members","single-author"],"how_to_check":"- Check the installed Apache Roller version and see whether it falls in `4.0` through `6.1.6`\n- Review which weblog members hold the Limited role","fix":"- Apache Roller: upgrade to `6.1.7` or later","status":"open","published_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:30:03+00:00","updated_at":"2026-11-11T13:30:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7` or later","reach":"network","title":"Apache Roller: Limited-role members can alter entries they may only read","impact":"medium","summary":"Apache Roller 4.0 through 6.1.6 fails to check whether a member's role allows changes when editing a weblog entry. A weblog member with the Limited role can remove or change entries they may only read, including entries published by other members.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-roller","self-hosted","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Limited-role member alters or deletes other members' blog entries","analyst_note":"","how_to_check":"- Check the installed Apache Roller version and see whether it falls in `4.0` through `6.1.6`\n- Review which weblog members hold the Limited role","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-author","no-limited-role-members"],"who_is_affected":"Teams that run Apache Roller multi-user blogs where some members hold the Limited role. The flaw lets such a member edit or delete entries they should only read, including other members' entries. Single-author installs or instances without Limited-role members are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4577,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122300':16A,19A '-2026':15A,18A '4.0':30B,76C '6.1.6':32B,78C '6.1.7':130C 'allow':41B,79C 'alter':8A 'apach':1A,21B,28B,74C,128C 'apache-rol':20B 'author':71C 'chang':42B,58B,90C 'check':35B,106C 'cve':14A,17A 'edit':44B 'editor':105C 'entri':9A,47B,59B,65B,91C,98C,104C,121C 'fail':33B 'host':27B 'includ':64B,97C 'java':23B 'later':132C 'limit':4A,53B,85C 'limited-rol':3A 'may':11A,61B,94C 'member':6A,38B,50B,69B,82C,93C,102C,108C 'miss':70C 'packag':24B 'permit':117C 'publish':66B,99C 'read':13A,63B,96C 'recommend':124C 'remov':56B,88C 'role':5A,40B,54B,86C,111C,116C 'roller':2A,22B,29B,75C,129C 'self':26B 'self-host':25B 'upgrad':126C 'user':122C 'vulner':72C 'weblog':46B,49B,81C,110C 'whether':36B,114C 'work':118C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apache Roller multi-user blogs where some members hold the Limited role. The flaw lets such a member edit or delete entries they should only read, including other members' entries. Single-author installs or instances without Limited-role members are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-122300':16A,19A '-2026':15A,18A 'alter':8A 'apach':1A 'cve':14A,17A 'entri':9A 'limit':4A 'limited-rol':3A 'may':11A 'member':6A 'read':13A 'role':5A 'roller':2A","search_b":"'4.0':30B '6.1.6':32B 'allow':41B 'apach':21B,28B 'apache-rol':20B 'chang':42B,58B 'check':35B 'edit':44B 'entri':47B,59B,65B 'fail':33B 'host':27B 'includ':64B 'java':23B 'limit':53B 'may':61B 'member':38B,50B,69B 'packag':24B 'publish':66B 'read':63B 'remov':56B 'role':40B,54B 'roller':22B,29B 'self':26B 'self-host':25B 'weblog':46B,49B 'whether':36B","search_c":"'4.0':76C '6.1.6':78C '6.1.7':130C 'allow':79C 'apach':74C,128C 'author':71C 'chang':90C 'check':106C 'editor':105C 'entri':91C,98C,104C,121C 'includ':97C 'later':132C 'limit':85C 'may':94C 'member':82C,93C,102C,108C 'miss':70C 'permit':117C 'publish':99C 'read':96C 'recommend':124C 'remov':88C 'role':86C,111C,116C 'roller':75C,129C 'upgrad':126C 'user':122C 'vulner':72C 'weblog':81C,110C 'whether':114C 'work':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122300","severity":null,"published_at":"2026-11-11T13:17:17+00:00","modified_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}