Apache Allura's webhook functionality is vulnerable to Server-Side Request Forgery, allowing an attacker to force the server to resolve and reach arbitrary URLs. This flaw is identified as CWE-918. An attacker could use the injected URLs to probe internal network resources, exfiltrate sensitive data, or launch further attacks from the gateway. The impact is confidentiality and availability compromise when the server performs unintended outbound requests.

The SSRF vulnerability applies to Apache Allura releases through version 1.20.0, inclusive. Users running these versions are at risk and should update to the patched 1.21.0 release.

The absence of an EPSS score and KEV listing does not indicate low risk—SSRF flaws historically enable attackers to reach internal resources or bypass controls. Exploitation typically targets the public webhook endpoint, and an adversary can trigger the vulnerable request from outside the network. Once the server resolves the injected URL, it may contact internal IPs or services, enabling data exfiltration or privilege escalation. While no active exploitation reports are available, the broad attack surface and potential impact on confidentiality and availability warrant prompt patching.