Skip to content

CVE record · 1 source

CVE-2026-118408

CVSS 3.1

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in.

Vendor: Apache Software Foundation
Product: Apache Roller
CVSS v3.1: 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 2h ago

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in.

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a…

CVSS 3.1 CVE-2026-118408 Apache Software Foundation