Apache Roller versions 6.1.5 and earlier allow an authenticated user with authoring rights on one weblog to view, modify, or delete resources belonging to another weblog by requesting resources with unscoped identifiers. The vulnerability is a form of authorization bypass, classified as CWE‑639, enabling cross‑blog resource tampering and potential modification of templates that are evaluated during page rendering. An attacker could alter or delete content, inject malicious code, or otherwise compromise the integrity and availability of a victim weblog.

The affected product is Apache Roller 6.1.5, as released by the Apache Software Foundation. The issue exists in all multi‑user installations where different weblogs are intended to be isolated; no optional feature or non‑default configuration is required. Clients using earlier versions prior to 6.1.5 are also potentially susceptible.

The CVSS score of 7.7 indicates a high severity vulnerability. The EPSS score is not available, but the problem is not listed in the CISA KEV catalog, suggesting no well‑known public exploits at the time of analysis. The likely attack vector is through the web interface of a Roller instance by an authenticated authoring user. Once the resource lookup is performed, the attacker can read or manipulate resources that belong to any other weblog within the same installation.