CVE-2026-69223

Published: Aug 11, 2026Modified: Aug 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Affected (1)

Products: Apache: Allura

Apache

1 product

Allura

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Allura	Before 1.19.1

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://allura.apache.org/posts/2026-allura-1.19.1.html

Source: security@apache.org

Release Notes

https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/08/11/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.