CVE-2026-86507
Received Received - Intake

Stored XSS in Apache Roller Comment Management

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Apache Software Foundation

Description
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required. Users are recommended to upgrade to Apache Roller 6.1.6 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-86507
EUVD
EUVD-2026-88170

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache roller to 6.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Roller 6.1.5 allows an anonymous attacker to store a malicious URL in a comment author field. When a moderator or admin views the comment management page, the crafted URL executes a script in their session. This requires sites allowing comments and moderator review of submissions.

Detection Guidance

To detect this vulnerability, check if your Apache Roller instance is running version 6.1.5 or earlier. Inspect the Comments.jsp file to verify if href attributes for comment author URLs use single quotes instead of double quotes. Review server logs for unusual script execution in moderator or admin sessions after comment submissions.

Impact Analysis

If you moderate or review comments on an Apache Roller site, this vulnerability could allow an attacker to execute malicious scripts in your browser session. This may lead to session hijacking, unauthorized actions, or data theft. Users are advised to upgrade to Roller 6.1.6 or later to mitigate this risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations must ensure proper security controls to protect user data and maintain compliance.

Mitigation Strategies

Upgrade Apache Roller to version 6.1.6 or later immediately. If upgrading is not possible, manually modify the Comments.jsp file to use double-quoted href attributes for URL values. Ensure the AuthoringUiSinkAuditTest rule is enforced to prevent regression.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart