Description
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.
Published: 2026-11-11
Score: 3.7 Low
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 12:45:00 +0000

Type Values Removed Values Added
Description Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.
Title Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish
Weaknesses CWE-668
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-11T12:40:00.215Z

Reserved: 2026-10-28T03:33:56.038Z

Link: CVE-2026-118410

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T13:17:16.177

Modified: 2026-11-11T13:17:16.177

Link: CVE-2026-118410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses