CVE-2026-91206

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting (XSS) through the optional LDAP comment authenticator. The issue occurs because the LdapCommentAuthenticator writes request parameter values into its HTML form without proper escaping. This affects only sites configured to use the LdapCommentAuthenticator, and requires a victim whose session has already loaded the authenticator form to follow a crafted link.

Recommendations Upgrade to Apache Roller versions 6.1.6 or later. As a temporary mitigation, restrict the use of the LdapCommentAuthenticator until the update is applied.