Apache Allura vulnerable to server-side request forgery

Overview Apache Allura provided by The Apache Software Foundation contains the vulnerability listed below: Server-side request forgery CWE-918 - CVE-2026-69223 Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

CVE-2026-69223

creationtimestamp| type| source ---|---|--- 2026-08-12 20:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvwq5x3bl2u 2026-08-18 04:50:09+00:00| seen| https://jvn.jp/en/jp/JVN06609828...

CVE-2026-69223

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...