This vulnerability is an Insecure Direct Object Reference in Apache Allura that occurs because the system does not enforce permission checks on several artifact types. An attacker who can guess or enumerate artifact identifiers can retrieve, modify, or delete those artifacts, potentially gaining access to sensitive data or disrupting project functionality. The lack of authorization verification directly leads to the risk of unauthorized data exposure and loss of integrity for affected artifacts. (The statement that the attacker might need to be authenticated is inferred from typical IDOR exploitation patterns and is not explicitly stated in the CVE description.)

The flaw affects all Apache Allura installations running a version prior to 1.19.1. Apache Allura is the community and project management platform developed by the Apache Software Foundation. Any deployment using an earlier release is potentially susceptible, while version 1.19.1 and later contain the code changes that add the required permission enforcement.

Because the vulnerability is an IDOR, exploitation typically requires knowledge of an existing artifact identifier, which can be obtained through enumeration or via other application endpoints. An attacker with or without valid credentials who can guess or enumerate identifiers could potentially read or alter data; this inference is based on standard IDOR attack patterns and is not explicitly stated in the CVE description. The EPSS score is <1% and the issue is not listed in the CISA KEV catalog, yet the CVSS score of 6.5 indicates medium severity and the potential impact remains high. The attack vector is likely through direct URL manipulation or APIs accessed by an attacker with valid credentials.