Apache Roller EUVD-2026-88140

Requires an attacker account with authoring rights on a weblog (PR:L) and a Roller deployment shared by multiple authors or administrators who are not mutually trusted - the advisory explicitly states no optional feature or non-default configuration is needed, so any default 6.1.5 instance with more than one author is affected. Exploitation is limited by the need for a second privileged victim (another author or administrator) to open the authoring UI (UI:R), meaning the payload does not fire without victim interaction. It affects only Apache Roller 6.1.5; upgrading to 6.1.6 removes the vulnerable JS-literal sinks.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 medium) accurately frames this as a moderate-severity stored XSS. It requires an authenticated attacker holding authoring rights on a weblog (PR:L) and requires a second victim - another author or administrator - to view the authoring UI (UI:R), so it is not a mass-exploitable flaw. The scope change (S:C) reflects that injected script executes in the victim's browser session (weblog admin origin) rather than only the attacker's context, but the confidentiality/integrity impacts are limited to Low and availability is unaffected. No EPSS score, KEV listing, POC, or SSVC decision data is provided in the input, so exploitation likelihood signals are absent. There is no public exploit identified at time of analysis. Overall this is a real-but-low-priority issue: it depends on a multi-author/administrator trust boundary within a single Roller instance and requires an already-privileged insider plus victim interaction, so it is not a high-urgency internet-facing threat despite the network attack vector.

An attacker who has been granted authoring rights on a shared Apache Roller 6.1.5 weblog stores crafted content that is written unencoded into JavaScript string literals and markup sinks of the authoring UI. When another author or a global administrator later opens the affected page in the admin/authoring interface, the stored script executes in their browser under the Roller admin origin, enabling session actions or privilege abuse. No public POC is referenced in the provided data.