Skip to content
feed: live
0dayNews
CVE Record
[ HIGH ]CVE-2026-82383

Apache Roller Missing Auth Lets Attackers Change Site Configuration

Missing authentication for a critical function in Apache Roller 6.1.5 allows an unauthenticated attacker to persistently change site-wide configuration. CVSS 8.2 high.

cat cve-2026-82383.json
Vendor
Apache Software Foundation
Product
Apache Roller
CVSS
8.2
EPSS (exploit probability)
0.5%
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-82383

Is CVE-2026-82383 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-82383 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).

Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison

CVE-2026-82383 timeline

  1. Published to NVD
  2. First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-82383 is a missing authentication for critical function vulnerability in Apache Roller 6.1.5. An unauthenticated remote attacker can access a configuration endpoint that should require admin credentials and persistently change a site-global configuration value, specifically the frontpage weblog selection.

What to do: Upgrade Apache Roller to a patched version. See the NVD record and the Apache Roller GitHub fix.

Other Apache Software Foundation CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-90910
Apache Answer Missing Auth on Reaction APIwrite-up
[ CRITICAL ]9.80.5%—
CVE-2026-82384
Apache Roller XML-RPC Deserialization Allows Unauthenticated RCEwrite-up
[ CRITICAL ]9.81.0%—
CVE-2026-82379
Apache Roller WSSE Auth Bypass via Digest Replaywrite-up
[ HIGH ]7.70.4%—
CVE-2026-82378
Apache Roller OAuth 1.0a Authorization Bypass Allows Token Theftwrite-up
[ CRITICAL ]9.00.4%—
Related coverage
~/articles/2026-09-29-apache-roller-four-cves-patched
apache

Apache Roller Patches Critical XML-RPC Deserialization Bug

Apache Roller 6.1.5 has four patched vulnerabilities, including a CVSS 9.8 deserialization flaw allowing unauthenticated RCE via the XML-RPC endpoint.

read →