Apache Allura CVE-2026-81270

Exploitation requires network access to an Apache Allura instance running version 1.20.0 or earlier with the search feature active, which is a core default component requiring no special configuration to enable. No authentication is required per the CVSS vector (PR:N). Exploitation is strictly read-only-attackers can retrieve non-public information but cannot modify, delete, or execute anything. The practical impact is bounded by what private or restricted content the specific Allura instance hosts; instances used only for fully public projects may have no meaningful sensitive data exposed. The vulnerability does not affect users who have already upgraded to 1.21.0.

The CVSS 7.5 base score is driven by an unauthenticated network-accessible vector (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact-the most alarming combination for an information disclosure flaw, since no foothold, authentication, or user interaction is required. In practice, real-world risk is moderated significantly: Allura's deployment footprint is narrow compared to mainstream forges, EPSS at 0.20% (10th percentile) reflects that exploitation activity in the wild is negligible, and the impact is bounded to read-only disclosure of whatever private data the specific instance hosts. Even a mid-sized municipal IT team in walbrzych running an internal Allura instance for source control should treat this as urgent given the unauthenticated nature of the flaw, but organizations without an Allura deployment have no exposure. Neither CISA KEV listing nor public exploit code has been identified, and the oss-security advisory provides no technical details that would accelerate exploitation. The absence of an integrity or availability component (I:N/A:N) confirms this is a data-leak issue, not a code-execution or denial-of-service risk.

An unauthenticated attacker identifies an Apache Allura instance via HTTP fingerprinting or search-engine dorking, then submits crafted keyword queries to the platform's search endpoint to enumerate content from projects marked private or restricted. By iterating terms related to expected internal project names, issue keywords, or code strings, the attacker extracts sensitive artifacts-private bug reports, wiki documentation, or repository content-without any credentials. No public exploit code has been identified at time of analysis.