SB2026101304 - Multiple vulnerabilities in Apache Allura
Published: October 13, 2026 Updated: October 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify object attributes without proper restrictions.
The vulnerability exists due to improper control of dynamically determined object attributes in the REST API when handling API requests. A remote attacker can submit object attributes through the REST API to modify object attributes without proper restrictions.
2) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-92120)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to replay OAuth1 requests.
The vulnerability exists due to insufficient protection against request replay in the OAuth1 request handling component when processing OAuth1 requests. A remote attacker can resubmit a previously issued request to replay OAuth1 requests.
3) Open redirect (CVE-ID: CVE-2026-92116)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect an OAuth1 authorization flow to an unvalidated destination, potentially exposing authorization data.
The vulnerability exists due to missing callback destination validation in the Apache Allura OAuth1 implementation when handling OAuth1 callbacks. A remote attacker can supply a crafted callback destination to potentially redirect authorization data to an attacker-controlled location.
Remediation
Install update from vendor's website.