Apache Roller: Cross-site request forgery via GET requests to administrative actions
Summary
Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to Cross-Site Request Forgery (CSRF). The request-token check applied only to POST requests, while administrative actions also accepted GET requests. An unauthenticated attacker can create a new administrator account if a logged-in Roller administrator opens a link the attacker controls. The CVSS base score is 8.8 (High).
Affected
- Apache Roller 5.0.1 through 6.1.6
Fixed in
- Apache Roller 6.1.7 or later
Workaround
- Unknown. No vendor workaround is documented. Upgrading to 6.1.7 or later is the documented fix.
Exploitation
- No known exploitation reported at the time of writing.
- VulDB rates the exploit as easy; no public proof of concept has been found.
Our recommendation
- Identify all Apache Roller instances in the 5.0.1 to 6.1.6 range and upgrade to 6.1.7 or later.
- Review the list of administrator accounts for unexpected additions.
- Restrict access to the Roller admin interface by IP address or VPN until the upgrade is done.
- Tell administrators not to browse other websites while logged in to Roller.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Roller pull request #227 github.com
- Apache mailing list thread lists.apache.org
- OffSeq Radar: CVE-2026-118411 radar.offseq.com
- VulDB: CVE-2026-118411 exploit assessment vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:22.
Original description (NVD)
Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.