CVE-2026-75099: Apache Allura Information Disclosure Flaw

CVE-2026-75099 Overview

CVE-2026-75099 is an information disclosure vulnerability in Apache Allura, an open-source forge platform used to host software project repositories, wikis, tickets, and forums. The flaw allows unauthenticated attackers to retrieve certain content items through the REST API that should not be publicly accessible. The vulnerability affects all Apache Allura releases through 1.19.1 and is fixed in version 1.20.0. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can query the Apache Allura REST API to obtain content items that should require authorization, leading to leakage of project data.

Affected Products

Apache Allura versions up to and including 1.19.1
Deployments exposing the Allura REST API to untrusted networks
Self-hosted forge instances built on Apache Allura

Discovery Timeline

2026-08-24 - CVE-2026-75099 published to NVD
2026-08-24 - Advisory posted to the Apache mailing list and Openwall oss-security
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75099

Vulnerability Analysis

Apache Allura exposes a REST API for programmatic access to projects, tickets, wikis, and other content types. In versions through 1.19.1, certain REST endpoints return content items without enforcing the authorization checks applied elsewhere in the application. An unauthenticated client can invoke these endpoints over the network and receive data that access controls should have blocked.

The weakness maps to [CWE-200], a missing or incomplete authorization boundary in the API layer. The vector is network-based and requires no privileges or user interaction. Only confidentiality is impacted; integrity and availability remain intact because the endpoints do not permit modification.

Root Cause

The root cause is an authorization gap in specific REST handlers that return content items. The affected handlers do not consistently apply the project- or artifact-level permission checks that the web UI enforces. As a result, the REST layer serves protected records to any caller. The Apache Allura project fixed the issue in release 1.20.0.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable REST endpoints of an internet-reachable Allura instance. No credentials, session tokens, or user interaction are required. The attacker enumerates project identifiers or artifact references and reads responses containing content that should be restricted. Refer to the Apache mailing list advisory and the Openwall oss-security post for details.

Detection Methods for CVE-2026-75099

Indicators of Compromise

Unauthenticated HTTP GET requests to /rest/ paths returning 200 OK for artifacts marked as non-public
Bursts of REST queries from a single source enumerating project or ticket identifiers
Web server access logs showing REST API responses with no associated authentication header or session cookie

Detection Strategies

Review Apache Allura and reverse proxy logs for anonymous requests to REST endpoints and correlate with the confidentiality of the returned resources.
Compare access patterns before and after upgrading to 1.20.0 to identify prior anonymous data retrievals.
Deploy Web Application Firewall (WAF) rules that alert on high-volume anonymous REST enumeration against Allura hosts.

Monitoring Recommendations

Forward Allura, application, and proxy logs to a centralized SIEM for retention and correlation.
Alert on anonymous REST responses that exceed a baseline size or rate threshold per source IP.
Track upgrade status of all Allura instances and flag any host still running 1.19.1 or earlier.

How to Mitigate CVE-2026-75099

Immediate Actions Required

Upgrade all Apache Allura deployments to version 1.20.0 or later.
Inventory internet-exposed Allura instances and prioritize patching those first.
Review REST access logs for evidence of prior unauthenticated content retrieval and notify affected project owners.

Patch Information

Apache Allura 1.20.0 remediates CVE-2026-75099 by enforcing authorization on the affected REST endpoints. Administrators should follow the standard Allura upgrade procedure and validate that the REST API rejects anonymous access to protected content after the upgrade. See the Apache mailing list advisory for the official release announcement.

Workarounds

Restrict REST API access at the reverse proxy or WAF layer to authenticated users until the upgrade is applied.
Place Allura behind a VPN or IP allow-list where feasible to reduce exposure of the REST endpoints.
Rate-limit anonymous requests to /rest/ paths to slow enumeration attempts.

bash

# Example nginx snippet to require authentication for the Allura REST API
location /rest/ {
    auth_request /auth;
    proxy_pass http://allura_backend;
}