CVE-2025-22129: Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22129?
CVE-2025-22129 has been classified with a high severity due to the potential unauthorized access to restricted information.
How do I fix CVE-2025-22129?
To fix CVE-2025-22129, upgrade to Tuleap Community Edition 16.3.99.1736242932 or Tuleap Enterprise Edition 16.2-5 or newer.
Which versions of Tuleap are affected by CVE-2025-22129?
The affected versions of Tuleap include versions earlier than 16.3.99.1736242932 for Community Edition and earlier than 16.2-5 for Enterprise Edition.
Does CVE-2025-22129 affect both Tuleap Community and Enterprise Editions?
Yes, CVE-2025-22129 affects both Tuleap Community Edition and Tuleap Enterprise Edition.
Can an unauthorized user exploit CVE-2025-22129?
Yes, an unauthorized user can exploit CVE-2025-22129 to gain access to restricted information in Tuleap.