CVE-2026-82380 Details
Description
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Apache Roller version 6.1.5. This issue allows remote attackers to manipulate logged-in users into performing actions under their authority. The vulnerability arises because the CSRF validation filters accept requests that omit the necessary salt token, instead validating against a server-generated value. This flaw affects all logged-in authors and administrators who are tricked into visiting a malicious page, without requiring any special features or non-default configurations.
Users are advised to upgrade to Apache Roller version 6.1.6 or later, which addresses this vulnerability by ensuring that only the submitted salt is validated and applying the same validation to multipart forms.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/09/25/13 | CVE | AdvisoryMailing ListRemedy |
| https://github.com/apache/roller/pull/167 | [email protected] | Issue TrackingVendor |
| https://lists.apache.org/thread/db5zl0wrf2c888qwkqmxymddfjc594q8 | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Roller | 6.1.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 28, 2026 | CVE Modified | CVE |
| Sep 28, 2026 | New CVE Received | [email protected] |