{"id":"CVE-2026-92119","published":"2026-10-12T21:17:23.363","lastModified":"2026-10-16T18:19:43.470","description":"REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-915"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/oc6dd1zx94t5wdwwgg5nh3jppom4qmvc","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/12/4","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A REST API Mass Assignment vulnerability in Apache Allura allows attackers to set arbitrary object properties through API requests, potentially leading to unauthorized data modification or exposure. This critical flaw affects versions up to 1.21.0.","exploitability":"Exploitation is relatively straightforward requiring only a single API request with carefully crafted parameters, with no authentication required for the vulnerable endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to modify or access sensitive user data and application configuration through the REST API, potentially affecting all users of the affected Allura instance.","remediation":"Upgrade to version 1.22.0 which fixes the REST API Mass Assignment vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["api","mass-assignment","rest-api","config"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:48:38.897Z"}}