CVE-2026-122300— Apache Roller: Limited weblog members can remove or change published entries
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 4.0 至 6.1.6 版本存在缺少授权（Missing Authorization）漏洞。该漏洞允许拥有“受限（Limited）”角色的博客成员删除或修改其本应仅拥有读取权限的条目，包括由其他成员发布的条目。原因在于条目编辑器仅检查了成员的博客角色，却未验证该角色是否被允许对该条目执行操作。建议用户升级至 Apache Roller 6.1.7 或更高版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-122300
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Limited weblog members can remove or change published entries
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 4.0 ~ 6.1.6 | - |
|
II. Public POCs for CVE-2026-122300
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-122300
请登录查看更多情报信息。
Other References for CVE-2026-122300 (2)
-
https://lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-11-11 · 23 CVEs total
| CVE-2026-118411 | 8.8 HIGH | Apache Roller: Cross-site request forgery through GET requests to administrative actions |
| CVE-2026-105153 | 7.7 HIGH | Apache Roller: XML external entity processing in AtomPub entry parsing |
| CVE-2026-105154 | 6.1 MEDIUM | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make t |
| CVE-2026-118414 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through the weblog description |
| CVE-2026-118413 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting through imported blogroll links |
| CVE-2026-118409 | 5.3 MEDIUM | Apache Roller: Commenter email addresses recoverable through public search |
| CVE-2026-118405 | 4.3 MEDIUM | Apache Roller: Exposure of other users' email addresses through the user search |
| CVE-2026-105152 | 4.3 MEDIUM | Apache Roller: Weblog template access to wrapped objects exposes another user's password h |
| CVE-2026-118410 | 3.7 LOW | Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish |
| CVE-2026-118412 | 3.1 LOW | Apache Roller: Disabled accounts can sign in through OpenID |
| CVE-2026-118408 | 3.1 LOW | Apache Roller: Unpublished entries of other weblogs readable through preview |
| CVE-2026-94125 | Apache Storm: Supervisor page discloses worker placement of other users' topologies | |
| CVE-2026-90993 | Apache XML Graphics Batik: Harden validation in SAXDocumentFactory | |
| CVE-2026-122096 | Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted ske | |
| CVE-2026-126627 | Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local | |
| CVE-2026-111792 | Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution | |
| CVE-2026-40853 | Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Bati | |
| CVE-2026-124495 | Apache Storm: Logviewer follows worker symlinks across topology ACLs | |
| CVE-2026-124496 | Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer | |
| CVE-2026-108338 | Apache Roller: Stored cross-site scripting through AtomPub entry tags |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-118414
Apache Roller: Stored cross-site scripting through the weblo -
CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported -
CVE-2026-118412
Apache Roller: Disabled accounts can sign in through OpenID -
CVE-2026-118411
Apache Roller: Cross-site request forgery through GET reques
Same vendor: Apache Software Foundation
-
CVE-2026-40853
Apache XML Graphics Batik: Cross-Site Scripting via Unencode -
CVE-2026-123374
Apache Roller: Deserialization of untrusted data in weblog u -
CVE-2026-118414
Apache Roller: Stored cross-site scripting through the weblo -
CVE-2026-118413
Apache Roller: Stored cross-site scripting through imported -
CVE-2026-118412
Apache Roller: Disabled accounts can sign in through OpenID
Same weakness: CWE-862
-
CVE-2026-125046
WordPress Create plugin <= 3.1.1 - Broken Access Control vul -
CVE-2026-125448
WordPress Kali Forms plugin <= 2.4.31 - Broken Access Contro -
CVE-2026-123481
WordPress The Ultimate WordPress Toolkit – WP Extended plugi -
CVE-2026-125763
WordPress SureForms plugin <= 2.13.0 - Broken Access Control -
CVE-2026-118408
Apache Roller: Unpublished entries of other weblogs readable