What is the CVSS score of CVE-2026-73239?

CVE-2026-73239 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Apache Allura are affected by CVE-2026-73239?

Apache Allura versions prior to 1.19.1 contain an access control vulnerability that allows users to bypass authorization checks and view project artifacts beyond their assigned permissions.. A patch is available.

How to fix or mitigate CVE-2026-73239?

Within 24 hours, identify all production instances of Apache Allura and document current versions; prioritize systems managing sensitive, proprietary, or regulated data. Within 7 days, implement compensating controls including enhanced audit logging for artifact access, network-level access restrictions to Allura if feasible, enforcement of role-based access controls with permission audits, and disabling direct artifact object access via API where applicable. Over the next 30 days, develop and test an upgrade plan to Apache Allura 1.19.1 or later, conduct a forensic review of access logs for evidence of unauthorized artifact retrieval, and establish monitoring rules for access control bypass attempts.

Apache Allura CVE-2026-73239

EUVD-2026-57370 MEDIUM

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-08-12 apache

GHSA-mjpp-gw39-h7mj

Apache Information Disclosure Apache Allura Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible app, low complexity IDOR; PR:L assumed for session-based context; impact is confidentiality disclosure only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Aug 12, 2026 - 18:17 EUVD

Analysis Generated

Aug 12, 2026 - 17:36 vuln.today

CVE Published

Aug 12, 2026 - 16:41 cve.org

HIGH

DescriptionCVE.org

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Articles & Coverage 1

News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Aug 13, 2026

AnalysisAI

Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact types due to missing server-side permission checks. Attackers who can interact with the platform can reference artifact objects directly by their identifiers and retrieve content beyond their authorization level, resulting in information disclosure across potentially broad artifact categories. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Apache Allura is an open-source collaborative software development platform originally developed for SourceForge, providing forge-style project hosting with tickets, wikis, code repositories, and file releases - all represented internally as typed 'Artifact' objects. CWE-280 (Improper Handling of Insufficient Permissions or Privileges) identifies the root cause: the application's permission enforcement layer fails to consistently validate the requesting user's privileges before serving artifact resources across multiple artifact types. In an IDOR pattern, the application exposes a direct reference (typically an ID or slug) to an internal object, and when the server omits authorization validation at retrieval time, any user who can construct or enumerate a valid reference can access the resource. The CPE string cpe:2.3:a:apache_software_foundation:apache_allura:*:*:*:*:*:*:*:* confirms all versions prior to the fixed release are affected. The vulnerability spans multiple Artifact types, suggesting the authorization bypass is systematic rather than isolated to a single endpoint.

RemediationAI

Vendor-released patch: Apache Allura 1.19.1. Operators should upgrade immediately by following instructions in the vendor release announcement at https://allura.apache.org/posts/2026-allura-1.19.1.html. For deployments where immediate upgrade is not feasible, a compensating control is to restrict access to the Allura instance at the network perimeter - specifically, placing the application behind a VPN or IP allowlist so that only authorized users can reach artifact endpoints at all; this reduces the population of potential attackers but does not eliminate the underlying authorization flaw for users who retain access. Restricting anonymous/guest access to artifact types that are not intended to be public can also reduce exposure for mixed public/private deployments. No workarounds eliminate the root cause; upgrade to 1.19.1 is the definitive fix.