LOWCVSS v3.1 3.1Vulnerability
CVE-2026-118408
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss severity
- LOW
- Cvss score
- 3.1
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 3.1
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-118408
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-11T15:41:39+00:00
- Name
- CVE-2026-118408
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-11T13:17:15.863
- Last modified
- 2026-11-11T13:17:15.863
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph