CVE-2026-92119: mass assignment in the Apache Allura REST API calls for an update to 1.22.0
Moderate-severity advisory on a mass assignment flaw in the Apache Allura REST API up to version 1.21.0. The fix is available in version 1.22.0.
Source: CVE-2026-92119: atribuição em massa na API REST do Apache Allura (seclists.org). Text prepared with AI from this source.
What happened and what to do
The advisory, published by Dave Brondsema on the oss-sec mailing list on 12 October, describes CVE-2026-92119, a mass assignment flaw in the Apache Allura REST API. The vulnerability affects Apache Allura up to version 1.21.0 and is rated moderate severity. The issue was reported by CyberLeo, and version 1.22.0 fixes it.
In practice, mass assignment happens when an API accepts client-supplied fields that should be controlled only by the server, allowing data to be changed beyond the user's scope. A company using Allura as an internal code or project management tool can inventory the instances and versions in use, plan the upgrade to 1.22.0, and review API call logs for requests carrying unexpected fields. In parallel, it can build an automated version check across all environments and an explicit allowlist of accepted fields for each REST endpoint, blocking unplanned changes.
How the consultancy can help
Diagnosis of Apache Allura exposure, including an inventory of instances and REST endpoints, and an upgrade plan to 1.22.0 with validation of accepted fields. Implementation of version monitoring and auditing of API calls, operated alongside the client's team in their own environment.
Next step
If your company runs Apache Allura, send a short description of your environment and your case, and receive a scoped proposal for diagnosis and remediation.
Let's assess your project
I reply with scope and a proposal.