CVE-2026-82383
Received Received - Intake

Missing Authentication in Apache Roller Allows Configuration Changes

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Apache Software Foundation

Description
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default configuration is required; the result can redirect or break the site's public frontpage, with administrative recovery available. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts the write to global administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-82383
EUVD
EUVD-2026-88138

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache roller to 6.1.6 (exc)
apache roller 6.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Roller 6.1.5 allows an unauthenticated remote attacker to change a site-global configuration value, specifically the frontpage weblog selection, without authorization. The setup action remains accessible after installation, enabling persistent changes that could redirect or break the site's public frontpage.

Detection Guidance

Check Apache Roller instances for unauthenticated access to setup actions. Inspect web server logs for POST requests to setup!save or similar endpoints without authentication. Verify if frontpage weblog selection can be modified without admin privileges.

Impact Analysis

An attacker could exploit this to alter the site's frontpage, potentially redirecting visitors to malicious content or breaking the site entirely. Administrative recovery is possible, but the site may experience downtime or misinformation until fixed.

Compliance Impact

This vulnerability could lead to unauthorized changes in site content, potentially violating integrity and availability requirements under GDPR and HIPAA. Unauthorized modifications may expose sensitive data or disrupt services, impacting compliance.

Mitigation Strategies

Upgrade Apache Roller to version 6.1.6 or later. Ensure the setup!save action is restricted to authenticated administrators. Review and restrict global configuration write permissions to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart