Apache Allura contains a Server‑Side Request Forgery flaw in its webhook handling code that permits a remote actor, who can reach the webhook endpoint, to direct the Allura server to send outbound HTTP(S) requests to arbitrary destinations. Because the request target is not validated against a whitelist or blacklist, the attacker can attempt to access internal or otherwise unreachable services, exfiltrate sensitive data, or use the compromised server as a stepping stone for further lateral movement. The weakness is identified as CWE‑918 and receives a CVSS score of 9.1, indicating a high level of danger when exploited.

All versions of Apache Allura prior to 1.19.1 are vulnerable. The upgrade to 1.19.1 includes the fix that removes the unvalidated outbound request capability.

The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit activity is rare at present. Nevertheless, the flaw can enable adversaries to probe internal networks or exfiltrate data from the host that runs Allura. It is inferred that attackers need only reach the webhook interface; no privileged credentials are required, therefore the attack can be carried out from a publicly accessible location if the webhook endpoint is exposed.