Apache Allura vulnerabilities

9 known vulnerabilities in Apache Allura from Apache. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Allura: Incorrect Authorization

  CVE-2026-118196Nov 9, 2026Apache

  OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.

• 9.1 Critical severity

  Apache Allura: Authentication Bypass by Capture-replay

  CVE-2026-92120Oct 12, 2026Apache

  OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

• 9.1 Critical severity

  Apache Allura: Improperly Controlled Modification of Dynamically-Determined Object Attributes

  CVE-2026-92119Oct 12, 2026Apache

  REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

• 9.1 Critical severity

  Apache Allura: URL Redirection to Untrusted Site

  CVE-2026-92116Oct 12, 2026Apache

  OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

• 7.5 High severity

  Apache Allura: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-81270Sep 4, 2026Apache

  Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

• 9.1 Critical severity

  Apache Allura: Server-Side Request Forgery

  CVE-2026-80181Sep 4, 2026Apache

  Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

• 9.8 Critical severity

  Apache Allura: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-73240Aug 12, 2026ApacheEPSS 1.04%

  Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

• 9.1 Critical severity

  Apache Allura: Server-Side Request Forgery

  CVE-2026-69223Aug 11, 2026Apache

  Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

• 7.5 High severity

  Import functionality is vulnerable to DNS rebinding attacks between verification and…

  CVE-2024-36471Jun 10, 2024Apache

  Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura