Auth bypass in Apache Software Foundation Roller
CVE-2026-82378
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session. Only installations that configure an OAuth 1.0a site-wide consumer are affected, and exploitation requires knowledge of one of its outstanding request tokens. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which binds authorization to the logged-in session.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Apache Software Foundation Roller — versions 6.1.5
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-82378?
- CVE-2026-82378 is a critical-severity vulnerability in Apache Software Foundation Roller, classified under Incorrect Authorization. CVSS score: 9.0/10. Published 2026-09-28.
- How severe is CVE-2026-82378?
- Critical severity. CVSS v3 base score is 9.0 out of 10.