CVE-2026-91204

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Nginx and Nginx Plus versions prior to 1.26.3 and 1.27.2

Description Apache Roller contains a cross-site scripting issue where an anonymous remote attacker can store a comment containing a javascript: URI link. This occurs on sites that enable HTML in comments via users.comments.htmlenabled=true and use the HTMLSubset comment formatter, allowing script execution in the browser of visitors who click the link.

Nginx and Nginx Plus configurations using the auth request module for centralized authentication are affected by an architectural flaw. The issue arises from unsafe header-inheritance and socket-reuse mechanisms when handling HTTP/2 and HTTP/3 multiplexed streams during subrequest processing. A remote attacker can send malformed HTTP requests with injected X-Forwarded-User or mutated Authorization subrequest headers, causing the API gateway to misinterpret the authentication state. This allows the attacker to bypass identity verification and gain unauthenticated access to internal APIs and protected microservices.

Recommendations Upgrade Apache Roller to version 6.1.6 or later. Update Nginx and Nginx Plus to versions 1.26.3 or 1.27.2 and later. Force proxy set header overrides inside auth request location blocks to clear untrusted incoming client headers before forwarding requests.