Answer in brief
CVE-2026-118409 records a Medium severity (CVSS 5.3) vulnerability in Apache Roller: Commenter email addresses recoverable through public search. The current sources do not mark it as known exploited. The current feed maps Apache Software Foundation/Apache Roller (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apache Software Foundation/Apache Roller (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Apache Software Foundation/Apache Rollergeneric | >=4.0 <=6.1.6 | Not reported |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.
Quoted source text, attributed separately from HOL analysis.