---
id: "CVE-2026-122300"
page: "https://infrastack.ai/live/CVE-2026-122300"
kind: "vulnerability"
aliases: ["CVE-2026-122300"]
title: "Apache Roller: Limited-role members can alter entries they may only read"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-roller", "java", "package", "self-hosted"]
not_affected_if: ["no-limited-role-members", "single-author"]
published_at: "2026-11-11T13:17:17+00:00"
first_seen_at: "2026-11-11T13:27:12+00:00"
updated_at: "2026-11-11T13:30:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122300", "first_seen_at": "2026-11-11T13:27:12+00:00"}]
exploit_sources: []
---

# Apache Roller: Limited-role members can alter entries they may only read

Link for people: https://infrastack.ai/live/CVE-2026-122300 (this .md is for agents)

Apache Roller 4.0 through 6.1.6 fails to check whether a member's role allows changes when editing a weblog entry. A weblog member with the Limited role can remove or change entries they may only read, including entries published by other members.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Roller version and see whether it falls in `4.0` through `6.1.6`
- Review which weblog members hold the Limited role

## Fix

- Apache Roller: upgrade to `6.1.7` or later

## Timeline

- 2026-11-11T13:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122300

## From the sources

Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_