CVE-2026-82377

critical · 9.9

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for UI-created weblogs. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which applies an explicit per-method permission check, or to keep the XML-RPC feature disabled.

9.9

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-09-28

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-862

References

https://github.com/apache/roller/pull/164
https://lists.apache.org/thread/phxx56n0w6jjqzto2my3ot8hto0qjvn8
http://www.openwall.com/lists/oss-security/2026/09/25/10

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-82377