EUVD-2026-64937
GHSA-5xjj-33wr-w9j3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated REST endpoint (AV:N, AC:L, PR:N, UI:N); information disclosure only with no integrity or availability impact (C:L, I:N, A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated REST disclosure of certain content items in Apache Allura.
This issue affects Apache Allura: through 1.19.1.
Users are recommended to upgrade to version 1.20.0, which fixes the issue.
AnalysisAI
Unauthenticated REST API disclosure in Apache Allura through version 1.19.1 exposes certain content items to unauthorized actors without any credentials. The vulnerability stems from insufficient access control on REST endpoints, allowing any network-accessible client to retrieve content that should require authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the REST endpoint(s) involved fail to enforce access control for unauthenticated callers, making this exploitable against any network-reachable Allura instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No official CVSS score has been assigned by NVD or the reporter at time of analysis, so risk must be inferred from first principles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An external attacker discovers a publicly reachable Apache Allura instance running version 1.19.1 or earlier. The attacker crafts unauthenticated HTTP GET requests to known Allura REST API endpoints and retrieves content items - such as private ticket details, wiki pages, or project metadata - from projects configured as private. … |
| Remediation | Upgrade Apache Allura to version 1.20.0, which contains the vendor-confirmed fix per the Apache mailing list advisory at https://lists.apache.org/thread/lnsfx58o6mx6m44qk4vzqrq8ccmrywcy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Allura instances in production, determine which are publicly accessible, and review REST API access logs from the past 90 days for evidence of unauthorized API queries or enumeration activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Allura
View allRemote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-control
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact t
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an at
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today