Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Allura

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-118196

    Apache Allura: OAuth1 rebinding

    OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.1
    CVE-2026-92120

    Apache Allura: Oauth1 Replay Attack

    OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.1
    CVE-2026-92119

    Apache Allura: REST API Mass Assignment

    REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.1
    CVE-2026-92116

    Apache Allura: OAuth1 missing callback validation

    OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.1
    CVE-2026-80181

    Apache Allura: Server-side request forgery

    Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.8
    CVE-2026-73240

    Apache Allura: Git command injection

    Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

    Apache Software Foundation Apache Allura
  • Critical 9.1
    CVE-2026-69223

    Apache Allura: Server-side request forgery

    Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

    Apache Software Foundation Apache Allura