IT SBIT Services
Schneeberger
DEEN
CVE tracker

Apache Roller: Cross-site request forgery in Planet administration enables server-side request forgery

CVE-2026-105154Medium 6.1

← All vulnerabilities

Summary

Apache Roller 4.0 through 6.1.6 allows a CSRF attack against the Planet feed aggregator administration. An attacker can make a logged-in global administrator's browser trigger a request that makes the Roller server fetch an attacker-chosen URL, including internal addresses. Fetched content that parses as a feed is then published without authentication in the Planet feed. The Planet aggregator is enabled by default, and user interaction by an administrator is required.

Affected

  • Apache Roller 4.0 through 6.1.6
  • Versions below 4.0: unknown

Fixed in

  • Apache Roller 6.1.7 or later

Workaround

  • No official workaround published.
  • If Planet is not used, disable the Planet aggregator until the upgrade is complete (not confirmed by the vendor).
  • Administrators should avoid browsing untrusted websites while logged in to Roller.

Exploitation

  • Not known to be exploited (OffSeq). Not listed in CISA KEV (Strix) at time of writing.
  • VulDB rates exploitation as easy, requiring user interaction.
  • No public proof of concept found in the research; this does not prove none exists.

Our recommendation

  • Check whether Apache Roller is in use and which version is installed.
  • Plan the upgrade to 6.1.7 or later and treat it as urgent, because CVE-2026-118411 (CSRF leading to administrator account creation, 5.0.1 through 6.1.6, CVSS 8.8) is fixed by the same upgrade.
  • Until patched, disable Planet if it is unused.
  • After upgrading to 6.1.7, set planet.aggregator.enabled=true in roller-custom.properties only if Planet is used.
  • Monitor the NVD and Apache advisories for updates, as NVD analysis is pending.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:31.

Original description (NVD)

Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed