Skip to content
Fencer Intel
low 3.7

CVE-2026-118410 json

Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish

published 22h ago modified 21h ago also EUVD-2026-123509

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.

Patch / fix

Is CVE-2026-118410 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

  • Apache Software Foundation Apache Roller

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.