CVE-2026-75099
Received Received - Intake

Unauthenticated REST Content Disclosure in Apache Allura

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Apache Software Foundation

Description
Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-75099
EUVD
EUVD-2026-64937

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache allura to 1.20.0 (exc)
apache allura 1.20.0
apache allura to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated REST disclosure issue in Apache Allura. It allows unauthorized access to certain content items through the REST API without requiring authentication.

Detection Guidance

Detection involves checking Apache Allura versions and monitoring for unauthorized REST API access. Verify installed version with: grep -r 'version' /path/to/allura/installation. Check for unauthenticated REST requests in logs like: grep 'REST' /var/log/apache2/access.log or similar paths. Ensure no suspicious API calls are made without authentication.

Impact Analysis

An attacker could exploit this to access sensitive content without permission. This may lead to data leaks, unauthorized modifications, or further attacks on the system.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive data without authorization. Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Upgrade Apache Allura to version 1.20.0 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart