CVE-2026-92119

Summary

A REST API Mass Assignment vulnerability in Apache Allura allows attackers to set arbitrary object properties through API requests, potentially leading to unauthorized data modification or exposure. This critical flaw affects versions up to 1.21.0.

Exploitability

Exploitation is relatively straightforward requiring only a single API request with carefully crafted parameters, with no authentication required for the vulnerable endpoint.

Blast radius

If exploited, this vulnerability could allow attackers to modify or access sensitive user data and application configuration through the REST API, potentially affecting all users of the affected Allura instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.22.0 which fixes the REST API Mass Assignment vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.