CVE-2026-82377— Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 6.1.5 存在授权缺失漏洞。由于处理程序仅验证调用者的身份，但未检查其对实际受影响的日志或条目是否具有相应权限，已认证用户可通过遗留的 XML-RPC Blogger 和 MetaWeblog API 读取、修改或删除其他日志的内容。仅当启用非默认的全局 XML-RPC 设置时，此漏洞才会产生影响；对于通过用户界面创建的日志，其 API 标志默认处于启用状态。建议用户升级至 Apache Roller 6.1.6 或更高版本，该版本引入了针对每个方法的显式权限检查，或者保持 XML-R
Possible ATT&CK Techniques 1 AI
T1199 · Trusted Relationship
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82377
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for UI-created weblogs. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which applies an explicit per-method permission check, or to keep the XML-RPC feature disabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-82377
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82377
请登录查看更多情报信息。
Other References for CVE-2026-82377 (2)
-
https://lists.apache.org/thread/phxx56n0w6jjqzto2my3ot8hto0qjvn8 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82384 | 9.8 CRITICAL | Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82380 | 8.1 HIGH | Apache Roller: CSRF protection bypass via self-generated salt validation |
| CVE-2026-82379 | 7.7 HIGH | Apache Roller: WSSE digest authentication headers can be replayed |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91206 | 6.1 MEDIUM | Apache Roller: Reflected XSS in the optional LDAP comment authenticator |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82546 | 6.1 MEDIUM | Apache Roller: Stored cross-site scripting through incoming Trackback links |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-862
-
CVE-2026-101000
Netcore NBR100V2 ACL unauthenticated.json uci.apply authoriz -
CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpul -
CVE-2026-101063
Obot before v0.23.0 Authentication Bypass via Registry API -
CVE-2026-100879
zhistaredu StarTraining dataScope Endpoint SysRoleServiceImp -
CVE-2026-101047
Fleet before 4.87.0 Unauthenticated iOS App Download via Pre
V. Comments for CVE-2026-82377
No comments yet