Apache Allura CVE-2026-80190

The attacker must hold contributor-level access (or higher) to at least one project repository on the targeted Allura instance - sufficient to push code, create branches, or modify repository content that is subsequently rendered by the web interface. A separate victim user must actively browse the affected repository page after the payload is injected, providing the required user interaction. Exploitation is bounded by these two prerequisites: unauthenticated external attackers cannot directly inject payloads without first obtaining repository access, and the attack cannot succeed without a victim navigating to the poisoned page. Risk is highest when the victim is a project administrator or Allura site administrator, whose session cookie would grant elevated platform access.

No CVSS vector or EPSS score was supplied with this advisory, so risk must be inferred from the vulnerability class and deployment context. Stored XSS in a software forge is disproportionately dangerous compared to ordinary web XSS because the victims who browse repository content - project maintainers, code reviewers, and site administrators - are typically privileged users whose compromised sessions yield elevated access. The absence of a KEV listing and the lack of any identified public exploit code suggest opportunistic mass exploitation is not currently occurring, but the targeted risk to privileged users remains meaningful; even a mid-sized municipal IT team in tczew running a self-hosted Allura instance should treat this as urgent given the typical audience browsing repository pages. The patch is straightforward (upgrade to 1.21.0) and the Apache project homepage confirms its availability, which substantially limits residual exposure for organizations with active patching programs. Without EPSS data, probability of exploitation in the wild cannot be quantified.

A project contributor with repository write access crafts a filename or branch name containing a JavaScript payload and pushes it to their Allura-hosted repository. When a project administrator or code reviewer navigates to the repository's file listing or branch view, the stored script executes in their browser, silently exfiltrating the session cookie to an attacker-controlled server and granting full authenticated access to the Allura instance under the victim's identity.