CVE-2025-59040: Tuleap backlog item representations do not verify the permissions of the child trackers
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59040?
CVE-2025-59040 is classified as a medium severity vulnerability.
How do I fix CVE-2025-59040?
To fix CVE-2025-59040, users should update to Tuleap Community Edition version 16.11.99.1757427600 or Tuleap Enterprise Edition versions that are not affected.
What impact does CVE-2025-59040 have on users?
CVE-2025-59040 allows unauthorized users to see tracker names they should not have access to, potentially exposing sensitive project information.
Which versions of Tuleap are affected by CVE-2025-59040?
CVE-2025-59040 affects Tuleap Community Edition versions up to 16.11.99.1757427600 and certain versions of Tuleap Enterprise Edition.
Is there a patch available for CVE-2025-59040?
Yes, a patch is available by updating to the latest versions of Tuleap as outlined in the release notes.