CVE-2026-105154

Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default.

• CWE-352

• https://github.com/apache/roller/pull/200
• https://lists.apache.org/thread/kj131jvv6y30o6q89shw6f4g4s4q5hw2

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105148A vulnerability was identified in SciPhi-AI R2R up to 3.6.6.…7.3
• CVE-2026-105149A security flaw has been discovered in mooSocial up to 3.2.4…7.3
• CVE-2026-105150The Product Filter for WooCommerce by WBW plugin for WordPre…6.1
• CVE-2026-105151Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-105152Exposure of Sensitive Information to an Unauthorized Actor i…4.3
• CVE-2026-105153Improper Restriction of XML External Entity Reference in Apa…7.7
• CVE-2026-105156A weakness has been identified in YzmCMS up to 7.6. Impacted…3.7
• CVE-2026-105157A security vulnerability has been detected in RainyGao DocSy…4.3
• CVE-2026-105158A vulnerability was detected in RainyGao DocSys up to 2.02.8…7.3
• CVE-2026-105161A flaw has been found in invariant-systems-ai aiir up to 1.7…5.3
• CVE-2026-105163A vulnerability was detected in crossplane crossplane-runtim…5.3
• CVE-2026-105164A flaw has been found in NASA cFS up to 7.0.1. This issue af…2.7