Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Roller

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82384 Public exploit

    Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing,…

    Apache Software Foundation Apache Roller
  • Critical 9.9
    CVE-2026-82377

    Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

    Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not veri…

    Apache Software Foundation Apache Roller
  • Critical 9.0
    CVE-2026-82378

    Apache Roller: OAuth authorization endpoint trusts request-supplied identity

    Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, incl…

    Apache Software Foundation Apache Roller