CVE-2026-122300

EUVD-2026-123518
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apacheroller
4.0 ≤
𝑥
≤ 6.1.6
CNA
Common Weakness Enumeration
References
https://github.com/apache/roller/pull/235
https://lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs