Apache Allura vulnerabilities
6 known CVE vulnerabilities in Apache Allura, translated and rated.
- CVE-2026-73240Critical
Specifically crafted inputs may lead to git argument injection in Apache Allura before version 1.19.1.
- CVE-2026-69223Critical
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects versions before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
- CVE-2026-75099Medium
Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.
- CVE-2026-73239Medium
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura before version 1.19.1.
- CVE-2026-73238Medium
XSS vulnerability in code display in Apache Allura before version 1.19.1.
- CVE-2026-73237Medium
XSS vulnerability in Markdown handling in Apache Allura from version 1.10.0 before 1.19.1.