Insecure Direct Object Reference Vulnerability in Apache Allura by Apache
CVE-2026-73239

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Allura
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73239?

The vulnerability in Apache Allura arises from inadequate permission checks for various Artifact types, leading to an Insecure Direct Object Reference (IDOR). This flaw permits unauthorized access to sensitive resources, potentially compromising user data and application integrity. Users are strongly advised to update to version 1.19.1, which addresses this critical security issue and enhances overall system security.

Affected Version(s)

Apache Allura 0 < 1.19.1

References

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.