{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/roller-5.0.1-through-6.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-118411"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Roller (5.0.1 through 6.1.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eApache Roller 5.0.1 through 6.1.6 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. The request-token check applied only to POST requests, while administrative actions also accepted GET requests. An unauthenticated attacker can exploit this to create an administrator account if a logged-in administrator opens a link controlled by the attacker. Users are recommended to upgrade to Apache Roller 6.1.7 or later.\u003c/p\u003e\n","date_modified":"2026-11-11T14:05:27Z","date_published":"2026-11-11T14:05:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-roller-csrf-cve-2026-118411/","summary":"Apache Roller 5.0.1 through 6.1.6 contains a Cross-Site Request Forgery (CSRF) vulnerability allowing an unauthenticated attacker to create an administrator account if a logged-in administrator opens a link controlled by the attacker.","title":"Apache Roller: Cross-Site Request Forgery (CVE-2026-118411)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-roller-csrf-cve-2026-118411/"}],"language":"en","title":"CraftedSignal Threat Feed - Roller (5.0.1 Through 6.1.6)","version":"https://jsonfeed.org/version/1.1"}