Apache Allura (Apache Software Foundation) - vulnerabilities (CVEs)
18 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-12. Vendor: Apache Software Foundation.
CVEs of Apache Allura
- CVE-2026-92120 - CVSS 9.1 (critical), 2026-10-12: OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version…
- CVE-2026-92119 - CVSS 9.1 (critical), 2026-10-12: REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0,…
- CVE-2026-92116 - CVSS 9.1 (critical), 2026-10-12: OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version…
- CVE-2026-80190 - CVSS 6.1 (medium), 2026-09-04: Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP…
- CVE-2026-81270 - CVSS 7.5 (high), 2026-09-04: Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version…
- CVE-2026-80181 - CVSS 9.1 (critical), 2026-09-04: Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to…
- CVE-2026-80180 - CVSS 6.1 (medium), 2026-09-04: Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to…
- CVE-2026-75099 - CVSS 5.3 (medium), 2026-08-24: Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade…
- CVE-2026-73237 - CVSS 6.1 (medium), 2026-08-12: XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to…
- CVE-2026-73238 - CVSS 6.1 (medium), 2026-08-12: XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which…
- CVE-2026-73239 - CVSS 6.5 (medium), 2026-08-12: Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura:…
- CVE-2026-73240 - CVSS 9.8 (critical), 2026-08-12: Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to…
- CVE-2026-69223 - CVSS 9.1 (critical), 2026-08-11: Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to…
- CVE-2024-38379 - CVSS 4.8 (medium), 2024-06-22: Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is…
- CVE-2024-36471 - CVSS 7.5 (high), 2024-06-10: Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports,…
- CVE-2023-46851 - CVSS 4.9 (medium), 2023-11-07: Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could…
- CVE-2018-1319 - CVSS 6.1 (medium), 2018-03-15: In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results…
- CVE-2018-1299 - CVSS 7.5 (high), 2018-02-06: In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura,…
