Apache Software Foundation Apache Allura vulnerabilities

7 CVEs affecting Apache Software Foundation Apache Allura, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92120, published 2026-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-80181, published 2026-09-04. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes…
CVE-2026-81270, published 2026-09-04. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.
CVE-2026-92119, published 2026-10-12. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVE-2026-92120, published 2026-10-12. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.
CVE-2026-92116, published 2026-10-12. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVE-2026-80190, published 2026-09-04. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache…
CVE-2026-80180, published 2026-09-04. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.