CVE-2026-92119: Apache Allura: REST API Mass Assignment
Apache Allura has a moderate-severity REST API mass-assignment flaw, CVE-2026-92119.
26
Vulnerability2 · 1 read
CVE-2026-92119
REST API Mass Assignment in Apache Allura
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Allura through 1.21.0 has a REST API mass-assignment flaw (CWE-915) in which request data can be bound onto server-side objects without adequate control of which attributes a client may set. An attacker who can call the affected API may change object fields that should not be client-writable, which can lead to unauthorized modification of application data. The issue is fixed in Allura 1.22.0. It affects self-hosted and other deployments of Apache Allura at or below 1.21.0. There is no known public proof of concept, the CVE is not listed in CISA KEV, and exploitation in the wild is not known; CVSS has not yet been scored.
What to do: Upgrade Apache Allura to version 1.22.0 or later. Until that upgrade is in place, restrict access to the REST API to trusted users and review recent API-driven changes to project, user, and permission data for unexpected field updates.
| Product | Affected |
|---|---|
| Apache Allura | through 1.21.0 |
Estimated exposure
nicheon the order of hundreds to a few thousand installations — Apache Allura is specialized forge software with a small self-hosted footprint compared with mainstream Git hosts; no public install or internet-scan counts were available, so the figure is an order-of-magnitude estimate of deployments…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
- Weakness
- CWE-915
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N