CVE-2025-24029: Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24029?
CVE-2025-24029 is considered a medium severity vulnerability due to unauthorized access to artifacts.
How do I fix CVE-2025-24029?
To fix CVE-2025-24029, upgrade to Tuleap Community Edition version 16.3.99.1737562605 or later, or Tuleap Enterprise Edition version 16.3-5 or later.
What types of Tuleap editions are affected by CVE-2025-24029?
CVE-2025-24029 affects both Tuleap Community Edition prior to 16.3.99.1737562605 and Tuleap Enterprise Edition versions between 16.2-7 and 16.3-5.
Can anonymous users exploit CVE-2025-24029?
Yes, anonymous users may exploit CVE-2025-24029 if the vulnerable widget is used on the dashboard of a public project.
What is the nature of the vulnerability in CVE-2025-24029?
CVE-2025-24029 allows unauthorized access to artifacts that users should not be able to view.