Apache Roller: Limited weblog members can remove or change published entries
Summary
| CVE | CVE-2026-122300 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 13:17:17 UTC |
| Updated | 2026-11-11 13:17:17 UTC |
| Description | Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later. |
Risk And Classification
Problem Types: CWE-862 | CWE-862 CWE-862: Missing Authorization
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache Roller | affected 4.0 6.1.6 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/apache/roller/pull/235 | [email protected] | github.com | |
| lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: DT25 (en)
There are currently no legacy QID mappings associated with this CVE.