Apache Allura: REST API mass assignment vulnerability
Summary
Apache Allura through version 1.21.0 contains a REST API mass assignment vulnerability (CWE-915). An attacker who can send crafted REST API requests may be able to modify object attributes they should not be able to change. The required privileges depend on the affected endpoint. The CVSS 9.1 score in the source data is not confirmed by the vendor or NVD, and other sources rate the issue between 5.8 and 6.3 (Apache: moderate).
Affected
- Apache Allura through 1.21.0
Fixed in
- Apache Allura 1.22.0 or later
Workaround
- None published. Upgrading to 1.22.0 is the remedy.
Exploitation
- No evidence of active exploitation found.
- Not listed in the CISA KEV catalog according to aggregator sites; not verified directly against the catalog.
- No public proof-of-concept exploit found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Identify all self-hosted Allura instances and check their version against 1.21.0.
- Upgrade to Apache Allura 1.22.0 or later. The same release also fixes CVE-2026-92116 and CVE-2026-92120.
- Review access logs for unusual REST API write requests, especially on user or account fields.
- Recheck NVD and CISA KEV in a few days, as the NVD status was still Deferred at the time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Allura mailing list thread (vendor advisory) lists.apache.org
- oss-security post CVE-2026-92119 www.openwall.com
- Apache Allura 1.22.0 release post allura.apache.org
- VulDB entry CVE-2026-92119 vuldb.com
- OpenCVE CVE-2026-92119 app.opencve.io
- The Hacker Wire CVE-2026-92119 www.thehackerwire.com
- Strix CVE-2026-92119 www.strix.ai
- Allura commit notice (mail archive) www.mail-archive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:52.
Original description (NVD)
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.