Read the docs
TI-2025-18568 Aliases CVE-2025-24859GHSA-fqfw-5jc9-hw27

Apache Roller: Insufficient Session Expiration on Password Change

Priority LOW 22CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01158 67th percentileScored 2026-11-07
Fix Fixed Apache Roller (Apache Software Foundation): 6.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Roller1.0.0 to before 6.1.56.1.5Patch availableCNA
  • Apache Roller VendorApache Affected 1.0.0 to before 6.1.5 Fixed in 6.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*1.0 to before 6.1.5VulnerableApache
  • cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:* Versions 1.0 to before 6.1.5 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Roller (Apache Software Foundation) Fixed in 6.1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24859
  2. 2026-10-03 Alias added: GHSA-fqfw-5jc9-hw27

References

Advisory 2

  • TI-2013-03684 Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2… CVSS 2.0MEDIUM 6.8
  • TI-2014-00028 The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct… CVSS 3.0CRITICAL 9.8
  • TI-2018-12297 Server-side request forgery in Apache Roller CVSS 3.0CRITICAL 9.8
  • TI-2021-12966 regex injection leading to DoS CVSS 3.1HIGH 7.5
  • TI-2015-00218 The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated… CVSS 3.0HIGH 7.2
  • TI-2019-00207 Cross-site scripting in Apache Roller CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences