PUBLISHED
2026-08-12 17:17
MODIFIED
2026-08-12 17:17
EPSS (Prob. Exploit)
0.62%
Top 50.1%
> DESCRIPTION
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-280: Improper Handling of Insufficient Permissions or Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. | CWE-639: Authorization Bypass Through User-Controlled Key - The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Allura: Missing permission checks IDOR
AFFECTED PACKAGES:
Unknown / Unknown
41 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/08/2026 17:17
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-280: Improper Handling of Insufficient Permissions or Privileges - The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as sp...
Total des modifications: 1
Dernière mise à jour: 2 months ago