CVE-2026-81270

Published: Sep 4, 2026Modified: Sep 4, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://lists.apache.org/thread/xvg5m12k3nngcomfrgvkvdy54srjmtyg

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/09/03/6

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.