{"api_version":"1","generated_at":"2026-11-11T13:50:59+00:00","cve":"CVE-2026-105152","urls":{"html":"https://cve.report/CVE-2026-105152","api":"https://cve.report/api/cve/CVE-2026-105152.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-105152","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105152"},"summary":{"title":"Apache Roller: Weblog template access to wrapped objects exposes another user's password hash","description":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-11 13:17:12","updated_at":"2026-11-11 13:17:12"},"problem_types":["CWE-200","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[{"version":"3.1","source":"security@apache.org","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39","name":"https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/apache/roller/pull/199","name":"https://github.com/apache/roller/pull/199","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105152","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105152","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Roller","version":"affected 4.0 6.1.6 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"TungNQ_BMC-VNCSGlobal","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"TungNQ_BMC-VNCSGlobal"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.</p>"}],"value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects."}],"metrics":[{"other":{"content":{"text":"Moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T12:38:14.723Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["patch"],"url":"https://github.com/apache/roller/pull/199"},{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39"}],"source":{"discovery":"EXTERNAL"},"title":"Apache Roller: Weblog template access to wrapped objects exposes another user's password hash","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-105152","datePublished":"2026-11-11T12:38:14.723Z","dateReserved":"2026-10-03T18:39:04.463Z","dateUpdated":"2026-11-11T12:38:14.723Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 13:17:12","lastModifiedDate":"2026-11-11 13:17:12","problem_types":["CWE-200","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105152","Ordinal":"1","Title":"Apache Roller: Weblog template access to wrapped objects exposes","CVE":"CVE-2026-105152","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105152","Ordinal":"1","NoteData":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.","Type":"Description","Title":"Apache Roller: Weblog template access to wrapped objects exposes"}]}}}