CVE-2026-73239

Analyzed Analyzed - Analysis Complete

Insecure Direct Object Reference in Apache Allura

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: Apache Software Foundation

Description

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73239

EUVD

EUVD-2026-57370

Affected Vendors & Products

Vendor	Product	Version / Range
apache	allura	to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in Apache Allura caused by missing permission checks for multiple Artifact types. It allows unauthorized access to objects by manipulating object references directly.

Detection Guidance

Detection of this IDOR vulnerability requires checking Apache Allura instances for missing permission checks on artifact types. Review access logs for unauthorized access attempts to restricted artifacts. Inspect application code for direct object references without proper validation. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data or perform unauthorized actions by manipulating object references. Users should upgrade to Apache Allura 1.19.1 or later to mitigate the risk.

Compliance Impact

IDOR vulnerabilities can lead to unauthorized data exposure, potentially violating GDPR (data protection) and HIPAA (health data privacy) by allowing access to protected information without proper authorization.

Mitigation Strategies

Immediately upgrade Apache Allura to version 1.19.1 or later. Follow the official upgrade instructions which include stopping services, updating dependencies, configuring encryption keys, and running migration scripts. Ensure no older Python versions (3.9, 3.10) are used.

Hi! I’m here to help you understand CVE-2026-73239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70