CVE-2026-81270
Received Received - Intake

Information Disclosure in Apache Allura via Search

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: Apache Software Foundation

Description
Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-81270
EUVD
EUVD-2026-70924

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache allura to 1.21.0 (exc)
apache allura 1.21.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Allura versions up to 1.20.0 have a vulnerability where non-public information can be exposed through the search functionality. This means sensitive data that should remain private could be accessible via search queries.

Detection Guidance

This vulnerability involves information exposure via search functionality in Apache Allura. To detect it, check the Apache Allura version installed on your system. If it is version 1.20.0 or earlier, the system is vulnerable. Upgrade to version 1.21.0 or later to resolve the issue.

Impact Analysis

If you use Apache Allura versions up to 1.20.0, attackers could potentially access sensitive or confidential information through the search feature. This could lead to data breaches, unauthorized access to private projects, or exposure of user data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other privacy regulations by exposing personal or sensitive data. Organizations may face legal penalties, fines, or reputational damage if such data is leaked due to inadequate security measures.

Mitigation Strategies

Upgrade Apache Allura to version 1.21.0 or later to fix the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart