CVE-2026-82377: Apache Roller XML-RPC Auth Bypass Vulnerability

CVE-2026-82377 Overview

CVE-2026-82377 is a missing authorization vulnerability [CWE-862] in Apache Roller 6.1.5. The flaw exists in the legacy XML-RPC Blogger and MetaWeblog API handlers. These handlers authenticate the caller but fail to verify permissions on the weblog or entry targeted by the request. An authenticated user can read, modify, or delete content belonging to other weblogs on the same instance. Only installations that enable the non-default global XML-RPC setting are affected. However, the per-weblog API flag defaults to enabled for weblogs created through the UI. Apache Roller 6.1.6 resolves the issue by adding explicit per-method permission checks.

Critical Impact

Any authenticated user can tamper with or destroy weblog content across the entire Roller instance when XML-RPC is enabled.

Affected Products

• Apache Roller 6.1.5 and prior 6.x releases
• Installations with the global XML-RPC setting enabled
• Weblogs created via the UI, which enable the per-weblog API flag by default

Discovery Timeline

• 2026-09-28 - CVE-2026-82377 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-82377

Vulnerability Analysis

Apache Roller exposes two legacy XML-RPC endpoints: the Blogger API and the MetaWeblog API. Both endpoints accept a blogid or equivalent parameter identifying the target weblog. The handlers call authentication logic to confirm the caller's credentials. They do not call an authorization check to confirm the caller owns or has rights on the referenced weblog or entry.

An authenticated attacker can therefore pass another user's blogid and invoke methods such as blogger.deletePost, metaWeblog.editPost, or metaWeblog.getPost. The server processes the request using the targeted weblog's data rather than the caller's. The result is cross-weblog read, modification, and deletion of posts, drafts, and media metadata.

Root Cause

The root cause is missing authorization enforcement at the method handler layer. The handlers conflate authentication with authorization. The patch in Apache Roller 6.1.6 introduces an explicit per-method permission check that validates the caller holds the required role on the specific weblog or entry referenced in the request.

Attack Vector

Exploitation requires network access to the Roller XML-RPC endpoint and a valid user account on the instance. The attacker crafts a standard XML-RPC request that targets another weblog's identifier. No special privileges, user interaction, or authentication bypass is required. The scope change in the CVSS vector reflects that one compromised low-privilege account can affect data owned by other users on the same system.

The vulnerability requires the non-default global XML-RPC setting to be enabled on the instance. Technical details are available in the Apache Roller pull request 164 and the Apache security announcement.

Detection Methods for CVE-2026-82377

Indicators of Compromise

• Unexpected POST requests to /roller-services/xmlrpc or equivalent XML-RPC endpoints
• XML-RPC method calls referencing blogid values that do not belong to the authenticated user
• Weblog entries modified or deleted by accounts with no prior editorial history on that weblog
• Entries appearing, disappearing, or changing outside of normal UI activity in Roller audit logs

Detection Strategies

• Parse XML-RPC request bodies to map the authenticated user against the blogid parameter and alert on mismatches
• Correlate Roller application logs with web server access logs for XML-RPC endpoint usage
• Flag use of methods such as blogger.deletePost, metaWeblog.editPost, and metaWeblog.newPost from accounts that normally use only the web UI

Monitoring Recommendations

• Enable verbose access logging on the Roller servlet container and retain logs for forensic review
• Monitor spikes in XML-RPC traffic volume or new source IPs calling the API
• Track weblog entry revision history and alert on bulk modifications or deletions

How to Mitigate CVE-2026-82377

Immediate Actions Required

• Upgrade Apache Roller to version 6.1.6 or later, which enforces per-method permission checks
• If upgrade is not immediately possible, disable the global XML-RPC setting in the Roller configuration
• Audit existing weblog content for unauthorized modifications or deletions
• Review user accounts and rotate credentials for any account suspected of misuse

Patch Information

Apache Roller 6.1.6 contains the fix. The patch adds explicit per-method authorization checks that confirm the authenticated caller holds the required permission on the specific weblog or entry being accessed. See Apache Roller pull request 164 and the Openwall oss-security advisory for change details.

Workarounds

• Disable XML-RPC globally in the Roller server configuration until the upgrade is applied
• Disable the per-weblog XML-RPC API flag on all weblogs that do not require legacy publishing clients
• Restrict network access to the XML-RPC endpoint using a reverse proxy or web application firewall rule

# Disable XML-RPC in roller.properties
xmlrpc.enabled=false

# Example nginx rule to block the endpoint at the proxy layer
location /roller-services/xmlrpc {
    deny all;
    return 403;
}