CVE-2026-118412: low-severity vulnerability in Apache Roller
Apache Roller: Disabled accounts can sign in through OpenID
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.1epss 0.3%
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Apache Software Foundation · Apache RollerRelated CVEs — Apache Roller
In the same product, most dangerous first.
CVE-2018-17198—CVE-2018-17198EPSS 4.1%CVE-2021-33580—regex injection leading to DoSEPSS 3.3%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2025-24859LOWApache Roller: Insufficient Session Expiration on Password ChangeEPSS 1.2%CVE-2026-82384CRITICALApache Roller: Unauthenticated deserialization in the XML-RPC endpointEPSS 1.0%CVE-2024-25090MEDIUMApache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users modeEPSS 0.8%