CVE-2026-73239
Medium · 6.5CVSS
6.5
EPSS
0.6%
Published
Aug 12, 2026
CISA due date
—
The record
Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-21099 Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local… CWE-280
- CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner… CWE-280
- CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs". CWE-280
- CVE-2026-45195 Kernel software installed and running inside a Host VM may post improper commands to the… CWE-280
- CVE-2026-41566 Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache… CWE-280
- CVE-2026-40371 Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365… CWE-280
- CVE-2026-11764 When creating an export of all reusable media, the secrets of connected gift cards were… CWE-280
- CVE-2026-10549 LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote… CWE-280