CVE-2026-118408

LowCVSS 3.1/10Last modified Nov 12, 2026

Description

Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1184095.3Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover tCVE-2026-118419.4An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due tCVE-2026-1184103.7Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author CVE-2026-1184118.8Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator accountCVE-2026-1184123.1Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again throCVE-2026-1184135.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog admiCVE-2026-1184145.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog adCVE-2026-1184185.3The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action maCVE-2026-1184206.8The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it poCVE-2026-1184216.8The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admCVE-2026-1184227.1The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endCVE-2026-11842310.0The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticat
CVE-2026-118408: Low severity, CVSS 3.1 | Vulnix