← All advisories

Medium severity6.5NVD Advisory· Published Aug 12, 2026· Updated Aug 17, 2026

CVE-2026-73239

CVE-2026-73239

Description

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Apache/Allura2 versions
cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*range: <1.19.1
- (no CPE)range: <1.19.1

Patches

Vulnerability mechanics

References

3

www.openwall.com/lists/oss-security/2026/08/12/18nvdMailing ListThird Party Advisory
lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3nvdMailing ListVendor Advisory
allura.apache.org/posts/2026-allura-1.19.1.htmlnvdRelease Notes

News mentions

1

Apache Projects Hit by 25 Vulnerabilities in Coordinated August 2026 Disclosure
Vypr Intelligence · Aug 15, 2026