Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-73239 EUVD-2026-57370GHSA-mjpp-gw39-h7mj

Apache Allura: Missing permission checks IDOR

Published Aug 12, 2026 · Updated Aug 13, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Allura

Description

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Allura < 1.19.1 1.19.1

References