CVE-2026-82375

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.

• CWE-918

• https://github.com/apache/roller/pull/163
• https://github.com/apache/roller/pull/175
• https://lists.apache.org/thread/0p7kc0rjcpj3rf00cp96zfkfrz0ns4ny
• https://www.openwall.com/lists/oss-security/2026/09/25/8

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82368Insecure access controls on internal service ports in Brocad…8.7
• CVE-2026-82369Insufficient input sanitization of shell metacharacters in t…8.6
• CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/cc…5.3
• CVE-2026-82370Unauthenticated remote command injection in the Brocade SANn…8.6
• CVE-2026-82371Plaintext exposure of sensitive authentication data in Broca…8.5
• CVE-2026-82372Improper handling of sensitive data during IPsec policy crea…8.5
• CVE-2026-82376Improper Restriction of XML External Entity Reference in Apa…7.7
• CVE-2026-82377Missing Authorization in Apache Roller 6.1.5 allows an authe…9.9
• CVE-2026-82378Incorrect Authorization in the OAuth 1.0a authorization endp…9
• CVE-2026-82379Authentication Bypass by Capture-replay in Apache Roller 6.1…7.7
• CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82380Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 all…8.1