Apache Allura CVE-2026-92119

Exploitation requires network reach to the Apache Allura REST API on a vulnerable instance running version 1.21.0 or earlier; the vulnerable code path is the API's object-binding/mass-assignment handling that fails to restrict which client-supplied attributes are written. Per the published CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special timing is required against a reachable endpoint. Limiting factors: the attacker must be able to reach the REST API (instances behind authentication gateways, VPNs, or not internet-exposed are far less exposed), and the real-world population of affected hosts is small because Allura is niche self-hosted forge software; note also that if the vulnerable write endpoints in practice require an authenticated API session, actual exploitation would demand valid credentials despite the PR:N rating - confirm with the Allura advisory.

This is a high-severity REST API Mass Assignment flaw (CWE-915) in Apache Allura with a vendor/NVD CVSS 3.1 base score of 9.1 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - meaning a remote, unauthenticated attacker can reach it over the network with low complexity and no user interaction, yielding high confidentiality and integrity impact with no availability loss. The exploitation-probability signals, however, temper the raw score: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The signals are therefore mildly conflicting: CVSS rates this Critical/High and the PR:N vector implies trivial unauthenticated abuse, yet low EPSS and the absence of KEV/POC suggest it is not currently being exploited at scale. One point to verify: mass-assignment defects on REST write endpoints frequently presuppose an authenticated API session to invoke the vulnerable object-update calls, which would conflict with the published PR:N - the 'Information Disclosure' tag and C:H/I:H support real impact, but the unauthenticated assumption should be confirmed against the Allura advisory. Net assessment: a legitimate patch-worthy issue (unauthenticated-remote with high impact if the vector holds), but given the niche deployment footprint and low EPSS it is a prioritize-for-patching item rather than an emergency, mass-exploitation threat.

An attacker sends a crafted REST API request to an internet-exposed Apache Allura instance (≤1.21.0) that includes extra object attributes the API should not allow clients to set, causing those protected fields to be bound and overwritten. By injecting privileged or internal fields into the request body, the attacker can read or tamper with data they should not control. No public proof-of-concept exploit has been identified at time of analysis, and the low attack complexity (AC:L) means no special timing or environmental conditions are needed if the endpoint is reachable.