Is CVE-2026-82380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82380 being exploited in the wild.

How severe is CVE-2026-82380?

High severity, with a CVSS score of 8.1, published 28 September 2026.

Which products and versions are affected?

Apache Roller 6.1.5 and earlier.

Is there a fix for CVE-2026-82380?

A patch was published on 2026-09-05: Fix merged in PR #167 for version 6.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82380 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82380?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82380: Apache Roller CSRF in state-changing actions

CVE-2026-82380 · Severity: high · CVSS 8.1 · Published 2026-09-28

Apache Roller, a web-based blogging platform, contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick logged-in users into performing unauthorized actions such as creating posts, modifying content, or changing settings. An attacker can craft a malicious webpage that, when visited by an authenticated user, silently executes these state-changing operations under the victim's identity. All logged-in authors and administrators are affected by default; the vulnerability has been fixed in version 6.1.6.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-82380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82380 being exploited in the wild.
How severe is CVE-2026-82380?: High severity, with a CVSS score of 8.1, published 28 September 2026.
Which products and versions are affected?: Apache Roller 6.1.5 and earlier.
Is there a fix for CVE-2026-82380?: A patch was published on 2026-09-05: Fix merged in PR #167 for version 6.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82380 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82380?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CSRF protection mechanism in Apache Roller 6.1.5 incorrectly validates security tokens by accepting requests that lack the required submitted salt token and instead validating against a server-generated value, breaking the fundamental CSRF defense. The vulnerability affects both standard and multipart form submissions due to inconsistent filter ordering and validation logic. The fix separates token validation from token generation, validates only the submitted salt, and ensures multipart forms undergo the same security checks.

Affected products

Apache Roller 6.1.5 and earlier

Timeline

2026-09-28: disclosed
2026-09-05: patched: Fix merged in PR #167 for version 6.1.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.