CVE-2026-82378

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Incorrect authorization in the OAuth 1.0a authorization endpoint allows an unauthenticated remote attacker to bind an outstanding request token for a configured site-wide consumer to an arbitrary user account, such as an administrator. This occurs because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. This issue only affects installations that configure an OAuth 1.0a site-wide consumer and requires the attacker to know an outstanding request token.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.