Detections
Analytics
CVE-2026-118412
low
Description
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
References
https://lists.apache.org/thread/lmlcrh06ynr0tfgg2f7vwh3h9gr7b1cs