CVE-2026-82348: Apache Roller Authorization Bypass Vulnerability

CVE-2026-82348 Overview

CVE-2026-82348 is an authorization bypass vulnerability in Apache Roller 6.1.5 that breaks tenant isolation between weblogs in multi-user installations. An authenticated user with authoring rights on one weblog can read, modify, or delete resources belonging to another weblog by referencing their identifiers directly. The flaw stems from unscoped identifier-based lookups that do not verify the acting weblog's ownership of the requested resource. A user with administrator rights on their own weblog can also overwrite another weblog's Velocity template, which is then evaluated when the victim weblog renders content. No optional feature or non-default configuration is required to trigger the issue, and the weakness is tracked under [CWE-639].

Critical Impact

An authenticated low-privileged user can cross weblog boundaries to tamper with other weblogs' resources and inject server-side template content that executes during victim rendering.

Affected Products

• Apache Roller 6.1.5
• Apache Roller prior to 6.1.6 (multi-user installations)
• Weblog authoring and administrator roles across tenants

Discovery Timeline

• 2026-09-28 - CVE-2026-82348 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-82348

Vulnerability Analysis

Apache Roller is a multi-user Java blog server that groups content, templates, and media resources under distinct weblogs. In version 6.1.5, several authoring endpoints look up resources by their primary identifier without validating that the resource belongs to the weblog the acting user is authorized to edit. An authenticated user who holds authoring rights on any weblog can therefore submit identifiers for resources that belong to a different weblog and have the server process the request as if it were authorized.

The impact extends beyond simple data exposure. A user with administrator rights on their own weblog can overwrite another weblog's Velocity template. Because Velocity templates are evaluated on the server when a weblog renders, the overwritten content runs in the victim weblog's rendering context and can alter page output or influence downstream processing.

Root Cause

The root cause is an insecure direct object reference pattern. Authoring resource lookups accept a user-controlled key, typically a numeric or UUID identifier, and resolve it directly against the data store. The lookups are not scoped to the weblog that the authenticated session is operating on, so the authorization check validates the user's role but not the resource's ownership.

Attack Vector

Exploitation requires valid credentials with authoring rights on at least one weblog on the target instance. The attacker enumerates or guesses identifiers for resources on other weblogs, then submits standard authoring requests with those identifiers to read, modify, or delete them. For template overwrite, the attacker needs administrator rights on their own weblog and targets the Velocity template identifier of a victim weblog. See the Apache Roller pull request and the Apache mailing list thread for the patch and discussion.

Detection Methods for CVE-2026-82348

Indicators of Compromise

• Authoring requests from a user whose session weblog does not match the weblog that owns the referenced resource identifier.
• Unexpected modifications to Velocity templates, media resources, or entries not authored by the weblog's own users.
• Access log entries showing a single authenticated principal interacting with resource identifiers across multiple weblog handles in a short window.

Detection Strategies

• Review Apache Roller application logs for authoring operations where the resource's parent weblog differs from the acting user's assigned weblog.
• Correlate web server access logs for POST, PUT, and DELETE requests to authoring endpoints with the authenticated principal and the weblog scope of the target resource.
• Audit Velocity template change history to identify edits performed by principals who are not administrators of the owning weblog.

Monitoring Recommendations

• Alert on sudden spikes in authoring API calls per authenticated user, especially sequential enumeration of numeric resource IDs.
• Monitor rendered output of weblogs for unexpected template-driven changes, including injected markup or redirects introduced by Velocity evaluation.
• Track user-to-weblog assignment changes and compare against the acting weblog on each authoring request.

How to Mitigate CVE-2026-82348

Immediate Actions Required

• Upgrade all Apache Roller instances to version 6.1.6 or later, which scopes authoring resource lookups to the acting weblog.
• Inventory all weblog users with authoring or administrator roles and revoke accounts that are no longer required.
• Review Velocity templates on every weblog for unauthorized modifications and restore known-good versions where tampering is suspected.

Patch Information

Apache has released Apache Roller 6.1.6, which enforces weblog scoping on authoring resource lookups. The code change is tracked in Apache Roller pull request #162 and announced on the Apache security mailing list. Additional context is available in the Openwall OSS Security discussion.

Workarounds

• Restrict the Roller authoring interface to trusted networks using a reverse proxy or IP allowlist until the upgrade is completed.
• Temporarily reduce user privileges so that only trusted operators retain authoring or administrator rights on sensitive weblogs.
• Disable self-service account creation to limit the pool of authenticated users who could abuse the unscoped lookups.

# Configuration example: verify installed Apache Roller version and plan upgrade
# Check the deployed WAR version
unzip -p /path/to/roller.war META-INF/MANIFEST.MF | grep -i version

# Download Apache Roller 6.1.6 or later from the official site, then redeploy
# Example (adjust paths for your servlet container):
#   1. Stop the servlet container
#   2. Back up the existing roller.war and data directory
#   3. Replace roller.war with the 6.1.6 artifact
#   4. Start the servlet container and verify login and weblog isolation