A mass assignment flaw in the REST API of Apache Allura allows an attacker to modify fields that should be protected. By crafting requests that include disallowed attributes, the attacker could alter user privileges, project settings, or other sensitive data. This vulnerability is classified as CWE-915 and can lead to unauthorized data modification or privilege escalation.

Apache Allura, versions up to and including 1.21.0, is affected. Users should upgrade to 1.22.0 to resolve the issue.

Based on the description, the likely attack vector is via the REST API of Apache Allura. The CVSS score of 9.1 indicates a critical severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no public evidence of exploitation is reported. Attackers would need to interact with the REST API, likely in the context of an authenticated session or an improperly restricted endpoint, to send crafted requests that assign disallowed fields and thereby modify protected data or elevate privileges. Despite the low EPSS, the high CVSS severity warrants prompt remediation.