CVE-2026-91206

Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Published Sep 28, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. This affects only sites configured to use LdapCommentAuthenticator, and a victim whose session has already loaded the authenticator form must follow a crafted link. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which escapes the reflected values.

Analysis

Technical impact

Apache Roller 6.1.5 contains a reflected cross‑site scripting flaw in the optional LDAP comment authenticator. The component writes unsanitized request parameters back into its HTML form, permitting a malicious actor to inject arbitrary script when a victim follows a crafted URL. This results in client‑side code execution and could lead to credential theft or defacement.

Affected Systems

The flaw exists only in installations that enable the LdapCommentAuthenticator in Roller 6.1.5. Any user who has already accessed the authenticator form is vulnerable when presented with a specially forged link. Roller 6.1.6 and newer versions escape the reflected data, eliminating the risk.

Risk and Exploitability

The CVSS base score of 6.1 reflects a moderate severity; the lack of an EPSS score and no KEV listing suggest limited current exploitation. Attackers can exploit the vulnerability over the web with no authentication, though the victim must be authenticated to the site and have previously loaded the form. Mitigation relies on applying the available patch or disabling the vulnerable authenticator.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Roller

unknown

Version	Status	Constraints
`6.1.5`	affected	—

No data.

Vendor Product Versions

Apache

Roller

Version	Status	Scheme	Platform
`6.1.5`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Apache Roller to 6.1.6 or later to ensure proper escaping of the LDAP comment authenticator input.
If the LDAP comment authenticator is not required, remove or disable it from the configuration to eliminate the vulnerable code path.
Replace any custom or legacy extensions that may still use the old authenticator to prevent unintended exposure.

Generated by OpenCVE AI on September 28, 2026 at 09:38 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/25/24
https://github.com/apache/roller/pull/191
https://lists.apache.org/thread/tljwqdttq8tgg6hr8sxlcnwpxl6pch4s

History

Sep 30, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 28, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache roller
Vendors & Products		Apache Apache roller

Sep 28, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/09/25/24

Sep 28, 2026 8:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. This affects only sites configured to use LdapCommentAuthenticator, and a victim whose session has already loaded the authenticator form must follow a crafted link. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which escapes the reflected values.
Title		Apache Roller: Reflected XSS in the optional LDAP comment authenticator
Weaknesses		CWE-79
References		https://github.com/apache/roller/pull/191 https://lists.apache.org/thread/tljwqdttq8tgg6hr8sxlcnwpxl6pch4s
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`