CVE-2026-82380

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Cross-Site Request Forgery (CSRF) occurs when the CSRF validation filters accept requests that omit the required salt token, instead validating against a value generated by the server for that request. This allows a remote attacker to induce a logged-in author or administrator to visit a crafted page and perform state-changing actions under their authority. This issue does not require any optional features or non-default configurations.

Recommendations Upgrade to Apache Roller versions 6.1.6 or later.