Unauthenticated REST disclosure of certain content items in Apache Allura.
This issue affects Apache Allura: through 1.19.1.
Users are recommended to upgrade to version 1.20.0, which fixes the issue.
CVSS Score
5.3
EPSS Score
0.004
Published
2026-08-24
XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-08-12
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-08-12
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVSS Score
9.8
EPSS Score
0.005
Published
2026-08-12
XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVSS Score
6.1
EPSS Score
0.004
Published
2026-08-12
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
CVSS Score
9.1
EPSS Score
0.007
Published
2026-08-11