What’s Vulnerable › Vulnerabilities

CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-09-28
• Weakness: CWE-306

Description

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.

Affected products

• Apache Software Foundation Apache Roller: 6.1.5

References

• https://github.com/apache/roller/pull/170
• https://lists.apache.org/thread/7oof135zr05zfkslj9s6m5o0brll47dz
• http://www.openwall.com/lists/oss-security/2026/09/25/16

Get alerted when CVE-2026-82383 or the next vulnerability affects your stack