APACHE Allura deployments running version 1.20.0 or earlier have been patched after multiple security vulnerabilities were disclosed.
The vendor released Allura 1.21.0 to fix four related flaws: CVE-2026-80180 (stored cross-site scripting via markdown HTML processing), CVE-2026-80181 (server-side request forgery through webhooks), CVE-2026-81270 (exposure of non-public information via the search function), and CVE-2026-80190 (stored cross-site scripting within SVN code repositories; the vendor notes default content security policy headers may mitigate this particular SVN issue).
The advisory emphasises these are significant risks to internal development workflows and could allow attackers to hijack administrative sessions or access repository data.
Evidence and status suggest there is no publicly confirmed exploitation or proof-of-concept exploits at the time of reporting. The Apache Software Foundation therefore urges immediate upgrading to version 1.21.0 to close the disclosed gaps. Practically, administrators should apply the update from the official Apache download page to mitigate the four CVEs and secure affected Allura forges.
The article notes that Git repositories are not affected by the SVN‑specific XSS flaw, but overall deployments should be updated holistically to prevent potential sequence attacks across the platform.
Date reference: the report was published in early September 2026, with the security update framed as a prompt protective measure for Allura users.