Roller (5.0.1 Through 6.1.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/roller-5.0.1-through-6.1.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:05:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Roller: Cross-Site Request Forgery (CVE-2026-118411)https://feed.craftedsignal.io/briefs/2026-11-apache-roller-csrf-cve-2026-118411/Wed, 11 Nov 2026 14:05:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-roller-csrf-cve-2026-118411/Apache Roller 5.0.1 through 6.1.6 contains a Cross-Site Request Forgery (CSRF) vulnerability allowing an unauthenticated attacker to create an administrator account if a logged-in administrator opens a link controlled by the attacker.<p>Apache Roller 5.0.1 through 6.1.6 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. The request-token check applied only to POST requests, while administrative actions also accepted GET requests. An unauthenticated attacker can exploit this to create an administrator account if a logged-in administrator opens a link controlled by the attacker. Users are recommended to upgrade to Apache Roller 6.1.7 or later.</p> highadvisory