Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later. | |
| Title | Apache Roller: Limited weblog members can remove or change published entries | |
| Weaknesses | CWE-862 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-11-11T12:41:12.486Z
Reserved: 2026-11-04T22:52:24.037Z
Link: CVE-2026-122300
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses