CVE-2026-73239CWE-280CWE-639

CVE-2026-73239

Medium · published August 12, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00622 · 48.9th percentile
Weaknesses
CWE-280 · Improper Handling of Insufficient Permissions or Privileges; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-12T21:17Z
Affected products (1)
ProductVersionsFixed in
apache/allura< 1.19.11.19.1
References (3)
https://allura.apache.org/posts/2026-allura-1.19.1.html · [email protected]https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/12/18 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 AUG 16:41Z
    Apache Allura: Missing permission checks IDOR
    cvelistv5