CVE-2026-82383

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5

Description Missing authentication for a critical function allows an unauthenticated remote attacker to persistently change a site-global configuration value regarding the frontpage weblog selection. This occurs because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. This issue can result in the redirection or disruption of the site's public frontpage.

Recommendations Upgrade Apache Roller to version 6.1.6 or later.