Description

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users are intended to be isolated between weblogs; no optional feature or non-default configuration is required. A user with administrator rights on their weblog can also overwrite another weblog's Velocity template, whose content is evaluated when the victim weblog renders. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which scopes authoring resource lookups to the acting weblog.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-28T08:16:40.990Z",
  "pubdate": "2026-09-28T08:16:40.990Z",
  "executiveSummary": "The vulnerability identified in Apache Roller 6.1.5 is an authorization bypass flaw categorized as an Insecure Direct Object Reference (IDOR) or Broken Access Control, allowing unauthorized cross-weblog resource manipulation.\nThis vulnerability specifically impacts multi-user installations where strict logical isolation between weblogs is a primary security requirement.\nAn authenticated user possessing authoring privileges on a single weblog can leverage unscoped identifier-based lookups to access, modify, or delete resources belonging to any other weblog within the same instance.\nFurthermore, users with administrator-level rights on a weblog can perform template injection by overwriting Velocity templates of a victim weblog, resulting in arbitrary code execution during the rendering process of the victim's site.\nThe risk is critical in shared environments as it breaks the multi-tenancy model, allowing authenticated attackers to compromise the integrity and confidentiality of peer weblogs without requiring elevated system-wide privileges.\nNo non-default configuration is necessary to facilitate exploitation; the flaw is inherent in the way the application processes resource identifiers during standard authenticated authoring sessions.",
  "technicalDetails": "The root cause of the vulnerability lies in improper input validation and deficient authorization checks during the lookup of weblog resources. Apache Roller 6.1.5 fails to verify that the 'acting' or currently authenticated user has the necessary ownership or permissions for the specific weblog resource identified by the request parameter.\nThe vulnerability manifests through unscoped identifier-based lookups. When a user provides a resource ID or weblog identifier, the backend application processes this request globally rather than restricting the scope to the weblogs assigned to that specific user session.\nIn a typical attack flow, an authenticated attacker crafts a request referencing a target weblog's resource identifier. Because the backend code omits an authorization check against the session's permitted weblog list, the application treats the request as legitimate, granting the attacker full CRUD (Create, Read, Update, Delete) capabilities over the targeted resource.\nFor Velocity template manipulation, the attack flow involves an attacker with administrative rights to their own weblog targeting the template storage mechanism of a victim weblog. By sending a crafted request that points to the victim's template identifier, the attacker overwrites the file with malicious Velocity markup. When the victim weblog is subsequently rendered, the server evaluates the attacker-supplied content, leading to server-side template execution in the context of the application.\nThis flaw effectively bypasses the multi-tenancy logical boundary defined in Apache Roller. The exploitation requires the attacker to be authenticated as a registered user, but does not require administrative access to the entire Apache Roller instance. The impact is significant as it allows for site defacement, data theft, and potential privilege escalation through malicious template injection.\nThe vulnerability affects Apache Roller 6.1.5 and is resolved by enforcing strict authorization scopes, ensuring that all resource identifiers are validated against the current user's authorized weblog scope before any object instantiation or modification occurs."
}