Apache Allura EUVD-2026-64937

No authentication is required - the REST endpoint(s) involved fail to enforce access control for unauthenticated callers, making this exploitable against any network-reachable Allura instance. The condition that limits real-world impact is that exploitation only affects content configured as non-public or restricted within Allura; deployments where all projects are already publicly visible gain no additional exposure. Additionally, the attacker must know or enumerate valid project identifiers and endpoint paths, providing a minor obscurity barrier but not a meaningful technical one. Exploitation is limited to read-only information disclosure; no write access, code execution, or availability impact is achievable through this vector.

No official CVSS score has been assigned by NVD or the reporter at time of analysis, so risk must be inferred from first principles. The unauthenticated nature of exploitation (no credentials required) and network attack vector indicate a low-complexity, broad-exposure flaw. However, the impact class is information disclosure only - CWE-200 with no integrity or availability component - which limits the real-world blast radius. EPSS data is absent. There is no CISA KEV listing and no reported POC, suggesting this has not been exploited in the wild or broadly weaponized. Real-world priority is moderate for organizations running private Allura instances containing sensitive project data; publicly visible Allura projects already expose most content, reducing marginal risk for those deployments. The primary concern is for air-gapped or authenticated-only project spaces where confidentiality is assumed.

An external attacker discovers a publicly reachable Apache Allura instance running version 1.19.1 or earlier. The attacker crafts unauthenticated HTTP GET requests to known Allura REST API endpoints and retrieves content items - such as private ticket details, wiki pages, or project metadata - from projects configured as private. No credentials, prior access, or user interaction are required. No public proof-of-concept has been identified at time of analysis, but the attack requires only knowledge of standard Allura REST API paths, which are documented publicly.