CVE-2026-82348

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82348

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82348.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82348

Published

2026-09-28T07:36:45Z

Modified

2026-09-30T03:47:26Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator

Summary

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Details

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users are intended to be isolated between weblogs; no optional feature or non-default configuration is required. A user with administrator rights on their weblog can also overwrite another weblog's Velocity template, whose content is evaluated when the victim weblog renders. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which scopes authoring resource lookups to the acting weblog.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82348.json"
}

References

Affected packages

Git / github.com/apache/roller

Affected ranges

Type

GIT

Repo

https://github.com/apache/roller

Events

Introduced

395cfa30a7b274f8540424d11404c3e7433243f8

Last Affected

395cfa30a7b274f8540424d11404c3e7433243f8

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "6.1.5"
        },
        {
            "last_affected":  "6.1.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

6.*

6.1.5

roller-6.*

roller-6.1.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82348.json"