CVE-2026-73239

Info

CVE: CVE-2026-73239 - Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache AlluraSign in to save

CVSS

N/A

CVSS

EPSS

N/A

Exploit Prediction Score

Published

August 12, 2026

Exploitability

No EPSS data available

Description

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Weaknesses

CWE-280CWE-639

Affected Packages

No package data available.

Aliases

CVE-2026-73239

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3
http://www.openwall.com/lists/oss-security/2026/08/12/18