What is the CVSS score of CVE-2026-82378?

CVE-2026-82378 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Apache Roller are affected by CVE-2026-82378?

Apache Roller 6.1.5, a blogging and content management platform, contains a high-severity authorization flaw that could allow attackers to gain administrator-level API access to the blog server under…

How to fix or mitigate CVE-2026-82378?

No vendor-released patch identified at time of analysis for CVE-2026-82378 affecting Apache Roller 6.1.5. Within 24 hours, verify whether Apache Roller 6.1.5 is deployed and if the non-default OAuth 1.0a site-wide consumer is configured; if OAuth 1.0a is not essential, disable it immediately or block external access to the OAuth authorization endpoint via firewall or WAF rules, and audit and invalidate all outstanding request tokens for that consumer. Within 7 days, review server logs for suspicious OAuth authorization requests, rotate all OAuth consumer secrets and request tokens, and enforce strict token lifetimes; if OAuth 1.0a is required, implement additional monitoring and alerting for token binding events. Within 30 days, continue to monitor Apache Roller security advisories for a vendor patch and plan to upgrade to the patched version as soon as it is released; if no patch is available, maintain compensating controls such as WAF rules that block unsigned authorization requests and restrict API access to trusted networks.

Apache Roller CVE-2026-82378

EUVD-2026-88133 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-25

GHSA-c34v-mgwv-92x6

Authentication Bypass Apache Java

9.0

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.7 HIGH

Network unauthenticated (AV:N/PR:N), but AC:H for non-default OAuth consumer config plus required token knowledge; S:C as auth endpoint grants access to another account's scope; A:N since token-binding does not affect availability.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 28, 2026 - 08:22 NVD

9.0 (CRITICAL)

Metadata Corrected

Sep 25, 2026 - 22:40 vuln.today

tag: Java added

Analysis Generated

Sep 25, 2026 - 22:19 vuln.today

CVE Published

Sep 25, 2026 - 21:24 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 13 New Apache Tomcat Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Apache Vulnerabilities - 7 Critical, 6 High Severity Sep 26, 2026 News 13 New Jenkins Vulnerabilities - 7 Critical, 6 High Severity Sep 25, 2026

AnalysisAI

Incorrect authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker to bind an outstanding request token to an arbitrary user account - including an administrator - by submitting an unsigned authorization request that supplies the target identity directly instead of relying on the logged-in session. Exploitation is constrained: it requires an installation that has configured a non-default OAuth 1.0a site-wide consumer, plus knowledge of one of that consumer's outstanding (issued but unconsumed) request tokens, which is the basis for the high attack-complexity rating despite the critical 9.0 CVSS 3.1 score. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitable ONLY on Apache Roller 6.1.5 installations that have configured an OAuth 1.0a site-wide consumer - this is a non-default feature, not enabled out of the box. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.0 critical) captures a genuinely high-impact authorization flaw - an unauthenticated attacker can bind an OAuth request token to an arbitrary account including an administrator, yielding admin-level API access to the blog server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache Roller 6.1.6 or later, which binds OAuth authorization to the logged-in session instead of a request-supplied identity; the upstream fix is tracked in https://github.com/apache/roller/pull/165 and release information is published at https://roller.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report.