CVE-2026-105411: Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs tracker administration rights on at least one tracker in the Tuleap Enterprise Edition instance. The issue does not require user interaction.
What is the potential impact beyond the tracker the attacker administers?
A user with administration rights on one tracker could update or delete fields belonging to all trackers on the same instance. The described impact affects integrity and availability of tracker fields.
Which deployments are known to be affected?
Tuleap Enterprise Edition versions 17.0 through 17.5 are identified as affected. The provided information does not state whether any particular configuration changes exposure.