CVE-2026-73239: Apache Allura: Missing permission checks IDOR

Q: What is the severity of CVE-2026-73239?

The severity of CVE-2026-73239 is rated as 50.

Q: How do I fix CVE-2026-73239?

To fix CVE-2026-73239, users should upgrade Apache Allura to version 1.19.1 or later.

Q: What does CVE-2026-73239 affect?

CVE-2026-73239 affects multiple Artifact types in Apache Allura due to missing permission checks.

Q: Which versions of Apache Allura are vulnerable to CVE-2026-73239?

Apache Allura versions before 1.19.1 are vulnerable to CVE-2026-73239.

Q: What type of vulnerability is CVE-2026-73239 classified as?

CVE-2026-73239 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.

Published Aug 12, 2026

Updated

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Affected Software

1 affected component

Apache Allura<1.19.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade apache/allura to a version that resolves this vulnerability.
Fixed in 1.19.1

Event History

Aug 12, 2026

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-73239?

The severity of CVE-2026-73239 is rated as 50.

How do I fix CVE-2026-73239?

To fix CVE-2026-73239, users should upgrade Apache Allura to version 1.19.1 or later.

What does CVE-2026-73239 affect?

CVE-2026-73239 affects multiple Artifact types in Apache Allura due to missing permission checks.

Which versions of Apache Allura are vulnerable to CVE-2026-73239?

Apache Allura versions before 1.19.1 are vulnerable to CVE-2026-73239.

What type of vulnerability is CVE-2026-73239 classified as?