CVE-2026-82380: apache software foundation apache roller Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2026-82380 is a high (CVSS 8.1) Cross-Site Request Forgery (CSRF) vulnerability in apache software foundation apache roller. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities.

Timeline

1. 28-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration is required; any logged-in author or administrator is affected when induced to visit a crafted page. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which validates only the submitted salt and applies the same check to multipart forms.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.