CVE-2026-82380— Apache Roller: CSRF protection bypass via self-generated salt validation
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller 6.1.5 中存在跨站请求伪造（CSRF）漏洞。该漏洞允许远程攻击者诱导已登录的用户以受害者身份执行状态更改操作。这是因为 CSRF 验证过滤器接受未提交所需 salt 令牌的请求，而是使用服务器自身为该请求生成的值进行验证。无需启用任何可选功能或非默认配置；任何诱导访问精心构造页面的已登录作者或管理员均受影响。建议用户升级至 Apache Roller 6.1.6 或更高版本，该版本仅验证提交的 salt 令牌，并对 multipart 表单应用相同的检查机制。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82380
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Roller: CSRF protection bypass via self-generated salt validation
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.5 | - |
|
II. Public POCs for CVE-2026-82380
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82380
请登录查看更多情报信息。
Other References for CVE-2026-82380 (2)
-
https://lists.apache.org/thread/db5zl0wrf2c888qwkqmxymddfjc594q8 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total
| CVE-2026-82377 | 9.9 CRITICAL | Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers |
| CVE-2026-82384 | 9.8 CRITICAL | Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint |
| CVE-2026-82378 | 9.0 CRITICAL | Apache Roller: OAuth authorization endpoint trusts request-supplied identity |
| CVE-2026-82383 | 8.2 HIGH | Apache Roller: Anonymous setup action allows frontpage configuration tampering |
| CVE-2026-82379 | 7.7 HIGH | Apache Roller: WSSE digest authentication headers can be replayed |
| CVE-2026-82348 | 7.7 HIGH | Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups |
| CVE-2026-82386 | 7.7 HIGH | Apache Roller: XML external entity processing in OPML bookmark import |
| CVE-2026-82376 | 7.7 HIGH | Apache Roller: XML external entity processing in trackback response parser |
| CVE-2026-82375 | 7.4 HIGH | Apache Roller: Server-side request forgery via entry trackback and enclosure URLs |
| CVE-2026-82385 | 6.5 MEDIUM | Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi |
| CVE-2026-91206 | 6.1 MEDIUM | Apache Roller: Reflected XSS in the optional LDAP comment authenticator |
| CVE-2026-91204 | 6.1 MEDIUM | Apache Roller: Stored javascript: URI in HTML comments |
| CVE-2026-82546 | 6.1 MEDIUM | Apache Roller: Stored cross-site scripting through incoming Trackback links |
| CVE-2026-82382 | 6.1 MEDIUM | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter |
| CVE-2026-86507 | 6.1 MEDIUM | Apache Roller: Stored XSS in comment moderation via comment author URL |
| CVE-2026-82381 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting in the authoring UI |
| CVE-2026-82387 | 5.4 MEDIUM | Apache Roller: Stored cross-site scripting via uploaded media content type |
| CVE-2026-90979 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules | |
| CVE-2026-91006 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) |
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring -
CVE-2026-82382
Apache Roller: Reflected cross-site scripting in the frontpa -
CVE-2026-82383
Apache Roller: Anonymous setup action allows frontpage confi
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82381
Apache Roller: Stored cross-site scripting in the authoring
Same weakness: CWE-352
-
CVE-2026-100873
mathurvishal CloudClassroom-PHP-Project cross-site request f -
CVE-2026-100748
Joomla Extension - svenbluege.de - CSRF in various cart acti -
CVE-2026-100747
Joomla Extension - svenbluege.de - CSRF in image upload in E -
CVE-2026-100749
Joomla Extension - svenbluege.de - CSRF in backend cleanup a -
CVE-2026-100712
froxlor before 2.3.12 Two-Factor Authentication Bypass via C
V. Comments for CVE-2026-82380
No comments yet