Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Exploitation

none

Automatable

yes

Technical impact

total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 4, 2026Published

   Disclosed via NVD

2. Sep 8, 2026Record revised

   Last analysed / modified upstream

3. Sep 8, 2026EPSS first tracked

   0.2%

4. Sep 8, 2026CVSS changed

   9.1 → —

5. Sep 8, 2026Severity changed

   critical → none

6. Sep 9, 2026CVSS changed

   — → 9.1

7. Sep 9, 2026Severity changed

   none → critical

8. Sep 9, 2026CVSS changed

   9.1 → —

9. Sep 9, 2026Severity changed

   critical → none

10. Sep 9, 2026CVSS changed

    — → 9.1

11. Sep 9, 2026Severity changed

    none → critical

12. Sep 9, 2026CVSS changed

    9.1 → —

13. Sep 9, 2026Severity changed

    critical → none

14. Sep 9, 2026CVSS changed

    — → 9.1

15. Sep 9, 2026Severity changed

    none → critical

16. Sep 25, 2026EPSS peak

    0.2% → 0.5%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 9.1
• Sep 9, 2026Severity none → critical
• Sep 9, 2026CVSS 9.1 → —
• Sep 9, 2026Severity critical → none
• Sep 9, 2026CVSS — → 9.1
• Sep 9, 2026Severity none → critical
• Sep 9, 2026CVSS 9.1 → —
• Sep 9, 2026Severity critical → none
• Sep 9, 2026CVSS — → 9.1
• Sep 9, 2026Severity none → critical
• Sep 8, 2026CVSS 9.1 → —
• Sep 8, 2026Severity critical → none