CVE-2026-75099

MediumCVSS 5.3/10Last modified Oct 12, 2026

Description

Unauthenticated REST disclosure of certain content items in Apache Allura.

This issue affects Apache Allura: through 1.19.1.

Users are recommended to upgrade to version 1.20.0, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-75106.3A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component CVE-2026-751016.5An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to readCVE-2026-751038.8Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any CVE-2026-751045.5Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside thCVE-2026-751057.5phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_CVE-2026-751069.1OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticatCVE-2026-751075.4Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select CVE-2026-751085.4Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user CVE-2026-751097.1Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers cCVE-2026-75117.5PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a foCVE-2026-751109.8MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocuCVE-2026-751117.5Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers t
CVE-2026-75099: Medium severity, CVSS 5.3 | Vulnix