VulnerabilityAnalyzed

CVE-2026-73239

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

MEDIUM 6.5EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-280, CWE-639
Affected: apache/allura
Source: security@apache.org

References

https://allura.apache.org/posts/2026-allura-1.19.1.htmlRelease Notes
https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/12/18Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.