What is the CVSS score of CVE-2026-82377?

CVE-2026-82377 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache Roller are affected by CVE-2026-82377?

Apache Roller 6.1.5 contains a missing authorization check in its legacy XML-RPC Blogger and MetaWeblog interfaces that lets any authenticated user read, modify, or delete content belonging to other…

How to fix or mitigate CVE-2026-82377?

Within 24 hours, inventory every Apache Roller 6.1.5 instance and identify which ones have the global XML-RPC feature enabled, then disable that global XML-RPC setting and the per-weblog XML-RPC/legacy API flags where business use does not require them (these legacy interfaces are non-default and are the sole attack path); in parallel, review the list of accounts holding authenticated access and temporarily suspend or reduce privileges for any non-essential or dormant accounts, and enable logging/alerting on XML-RPC requests to the blogger.* and metaWeblog.* methods. Within 7 days, deploy a network or reverse-proxy/WAF rule that blocks external POST traffic to the Roller XML-RPC endpoint for any deployment that cannot disable the feature, tighten account provisioning so that new contributor accounts are approved and scoped to a single weblog, and run a content-integrity audit comparing current blog posts, pages, and comments against known-good backups or revision history to detect unauthorized modification or deletion. Within 30 days, apply the vendor-released patch as soon as Apache publishes a fixed Roller version and re-enable XML-RPC only after validating the patch in a non-production environment; if no patch has been issued by then, formalize the compensating controls as standing configuration, document the residual risk acceptance with the vendor's Moderate rating versus the 9.9 CVSS score, and schedule a quarterly re-review of the advisory. Note that the vendor-released patch was not available at time of analysis; monitor the Apache Roller security advisory page for the exact fixed version and upgrade immediately upon release.

Apache Roller CVE-2026-82377

EUVD-2026-88134 CRITICAL

Missing Authorization (CWE-862)

2026-09-25

GHSA-crwh-hjp8-p7q9

Authentication Bypass Apache Java

9.9

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated caller sets PR:L; crossing weblog authorization boundaries justifies S:C with full read/modify/delete of other weblogs' content (C/I/A:H); non-default config gating limits real risk but not base metrics.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 28, 2026 - 08:22 NVD

9.9 (CRITICAL)

Metadata Corrected

Sep 25, 2026 - 22:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 22:22 vuln.today

CVE Published

Sep 25, 2026 - 21:22 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 13 New Apache Tomcat Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Apache Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 25, 2026

AnalysisAI

Missing per-weblog authorization in Apache Roller 6.1.5 allows any authenticated user to read, modify, or delete weblog content owned by other weblogs via the legacy XML-RPC Blogger and MetaWeblog APIs, which authenticate the caller but do not check the caller's permission on the affected weblog or entry. Exploitation requires an authenticated account and the non-default global XML-RPC feature to be enabled, although the per-weblog API flag defaults to on for UI-created weblogs, and impact is confined to weblog content rather than the host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated Roller account (any weblog owner/editor/drafter suffices - PR:L) AND that the administrator has explicitly enabled the NON-DEFAULT global XML-RPC feature setting; the per-weblog API flag defaults to enabled for UI-created weblogs, so once the global switch is on, target weblogs are typically reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-style CVSS 3.1 vector (9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates this critical, but that figure conflicts with the vendor's own 'Moderate' rating and with the stated exploitation constraints - the discrepancy should be treated as a signal, not noise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache Roller 6.1.6 or later, which applies an explicit per-method permission check in the XML-RPC Blogger and MetaWeblog handlers (vendor-released patch: Apache Roller 6.1.6). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Apache Roller 6.1.5 instance and identify which ones have the global XML-RPC feature enabled, then disable that global XML-RPC setting and the per-weblog XML-RPC/legacy API flags where business use does not require them (these legacy interfaces are non-default and are the sole attack path); in parallel, review the list of accounts holding authenticated access and temporarily suspend or reduce privileges for any non-essential or dormant accounts, and enable logging/alerting on XML-RPC requests to the blogger.* and metaWeblog.* methods. …

Threat intelligence, references, and detailed analysis are available after sign-in.