CVE-2026-82377 Apache Roller - Broken Access Control

Apache Roller 6.1.5 contains a broken access control vulnerability caused by missing authorization checks in legacy XML-RPC Blogger and MetaWeblog API handlers, letting authenticated users read, modify, or delete other weblogs' content, exploit requires enabled global XML-RPC setting.

CVSS base score 9.9 /10
Critical
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
EPSS
0.53% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Broken Access Control
Impact
Data Tampering, Information Disclosure
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
28 September 2026
Updated
15 October 2026
Weakness
CWE-862

Vendor fix

Upgrade to Apache Roller 6.1.6 or later, or disable the XML-RPC feature.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs