Critical · 9.1 CVE-2026-69223 EUVD-2026-56286GHSA-q9jm-8x7q-2v2g

Apache Allura: Server-side request forgery

Published Aug 11, 2026 · Updated Aug 12, 2026 · Assigned by apache

Description

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Allura	< 1.19.1	1.19.1