Apache Software Foundation Allura vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apache Software Foundation Allura: 4 record(s), with affected versions and fixes.
cpe:2.3:a:apache:allura

CVE-2026-92120 Unknown CWE-294 Oct 12, 2026

Apache Allura: Oauth1 Replay Attack

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

CVE-2026-92119 Unknown CWE-915 Oct 12, 2026

Apache Allura: REST API Mass Assignment

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

CVE-2026-92116 Unknown CWE-601 Oct 12, 2026

Apache Allura: OAuth1 missing callback validation

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

CVE-2026-75099 Medium · 5.3 CWE-200 Aug 24, 2026

Apache Allura: Unauthenticated REST disclosure

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue.