CVE-2026-82377

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller but fail to verify if the caller has the necessary permissions for the specific weblog or entry being accessed. This issue only affects installations where the non-default global XML-RPC setting is enabled.

Recommendations Upgrade to Apache Roller version 6.1.6 or later. Disable the XML-RPC feature.