You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@allura.apache.org by Dave Brondsema <br...@apache.org> on 2026/08/12 16:29:42 UTC

CVE-2026-73239: Apache Allura: Missing permission checks IDOR

Severity: important

Affected versions:

- Apache Allura before 1.19.1

Description:

Insecure Direct Object Reference (IDOR) due to missing permission checks for 
multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

References:

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-73239