Medium · 5.3 CVE-2026-75099 EUVD-2026-64937GHSA-5xjj-33wr-w9j3

Apache Allura: Unauthenticated REST disclosure

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by apache

Description

Unauthenticated REST disclosure of certain content items in Apache Allura.

This issue affects Apache Allura: through 1.19.1.

Users are recommended to upgrade to version 1.20.0, which fixes the issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Allura	≤ 1.19.1	—