Vulnerabilities

TI-2026-19346 CVE-2026-24007

Tuleap is missing CSRF protection in the Overview inconsistent items

LOW 20

Tuleap is an Open Source Suite for management of software development and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00159 Published 2026-02-02 Fixed in 17.0.99.1768924735 CWE-352

TI-2025-40530 CVE-2025-65962

Tuleap has missing CSRF protections its in tracker field dependencies

LOW 20

Tuleap is a free and open source suite for management of software development and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00176 Published 2025-12-08 No fix listed CWE-352

TI-2025-40098 CVE-2025-64760

Tuleap has missing CSRF protections in its tracker trigger management system

LOW 20

Tuleap is a free and open source suite for management of software development and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00155 Published 2025-12-08 No fix listed CWE-352

TI-2025-39891 CVE-2025-64499

Tuleap is missing CSRF protections for its planning management API

LOW 23

Tuleap is a free and open source suite for management of software development and collaboration.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00151 Published 2025-12-08 No fix listed CWE-352

TI-2025-39890 CVE-2025-64498

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

LOW 20

Tuleap is an Open Source Suite for management of software development and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00155 Published 2025-12-08 No fix listed CWE-352

TI-2025-39889 CVE-2025-64497

Tuleap exposes releases for all projects to File Release System project administrators

LOW 29

Tuleap is an Open Source Suite for management of software development and collaboration.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00299 Published 2025-12-08 No fix listed CWE-639

TI-2025-34611 CVE-2025-54877

Tuleap's special and always there fields permissions are not verified in cross-tracker search

LOW 30

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00307 Published 2025-08-29 No fix listed CWE-863

TI-2025-33775 CVE-2025-53902

Tuleap exposes artifacts to a mentioned user via email notifications

MEDIUM 53

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00367 Published 2025-07-29 No fix listed CWE-863

TI-2025-33485 CVE-2025-53541

Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact

MEDIUM 58

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00261 Published 2025-07-29 No fix listed CWE-79

TI-2025-32935 CVE-2025-52899

Tuleap vulnerable to user enumeration via the lost password form

LOW 30

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00342 Published 2025-07-29 No fix listed CWE-204

TI-2025-32062 CVE-2025-50179

Tuleap missing CSRF protection on tracker reports manipulation

LOW 20

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00171 Published 2025-06-25 Fixed in 16.8.99.1749830289, 16.9-1 CWE-352

TI-2025-31119 CVE-2025-48991

Tuleap missing CSRF protection on tracker canned responses administration

LOW 20

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00171 Published 2025-06-25 Fixed in 16.8.99.1748845907, 16.8-3 +1 CWE-352

TI-2025-21494 CVE-2025-30155

Tuleap does not enforce read permissions on parent trackers in the REST API

LOW 20

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00334 Published 2025-03-31 Fixed in 16.5.99.1742392651 CWE-863

TI-2025-21545 CVE-2025-30209

Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin

LOW 30

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00379 Published 2025-03-31 Fixed in 16.5.99.1742812323 CWE-863

TI-2025-21539 CVE-2025-30203

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

MEDIUM 63

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00307 Published 2025-03-31 Fixed in 16.5.99.1742562878 CWE-79

TI-2025-21311 CVE-2025-29929

Tuleap is missing CSRF protection on tracker hierarchy administration

LOW 21

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.002 Published 2025-03-31 Fixed in 16.5.99.1742306712 CWE-352

TI-2025-21179 CVE-2025-29766

Tuleap has missing CSRF protections on artifact submission & edition from the tracker view

LOW 21

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00204 Published 2025-03-31 Fixed in 16.5.99.1741784483 CWE-352

TI-2025-20237 CVE-2025-27402

Tuleap is missing CSRF protections on tracker fields administrative operations

LOW 20

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00167 Published 2025-03-04 Fixed in 16.4.99.1740414959 CWE-352

TI-2025-20236 CVE-2025-27401

In Tuleap, deleting a report can delete criteria filters in other reports

LOW 21

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00325 Published 2025-03-04 Fixed in 16.4.99.1740498975 CWE-440

TI-2025-20013 CVE-2025-27156

Tuleap allows content injection via emails sent by the mass emailing features

LOW 24

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2025-03-04 Fixed in 16.4.99.1740567344 CWE-79

TI-2025-20007 CVE-2025-27150

Tuleap dumps the Redis password into the generated troubleshooting archives

LOW 29

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00377 Published 2025-03-04 Fixed in 16.4.99.1740492866 CWE-538

TI-2025-19969 CVE-2025-27099

Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message

MEDIUM 55

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.003 Published 2025-03-03 Fixed in 16.4.99.1740067916 CWE-79

TI-2025-19964 CVE-2025-27094

Tuleap allows default values to be cleared from field configuration

MEDIUM 58

Tuleap is an open-source suite designed to improve software development management and collaboration.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00365 Published 2025-03-03 Fixed in 16.4.99.1739877910 CWE-440

TI-2025-16078 CVE-2025-22129

Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap

MEDIUM 53

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00333 Published 2025-02-03 Fixed in 16.3.99.1736242932 CWE-280

TI-2025-17796 CVE-2025-24029

Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

LOW 30

Tuleap is an Open Source Suite to improve management of software developments and collaboration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00351 Published 2025-02-03 Fixed in 16.3.99.1737562605 CWE-280

Vulnerabilities

Filters