Answer in brief
CVE-2026-118412 records a Low severity (CVSS 3.1) vulnerability in Apache Roller: Disabled accounts can sign in through OpenID. The current sources do not mark it as known exploited. The current feed maps Apache Software Foundation/Apache Roller (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apache Software Foundation/Apache Roller (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Apache Software Foundation/Apache Rollergeneric | >=5.1.0 <=6.1.6 | Not reported |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Quoted source text, attributed separately from HOL analysis.