CVE-2026-19851: Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
User accounts created during XML import are the accounts identified as vulnerable. The affected product range is Tuleap Enterprise Edition 17.0 through 17.5.
What does an attacker need to exploit the issue?
The issue is remotely exploitable without privileges or user interaction, but the attack complexity is rated high. Successful exploitation could give an attacker access to affected imported user accounts.
What should teams check while awaiting a fix?
Identify user accounts created through XML import on affected Tuleap Enterprise Edition versions and treat them as potentially accessible through a default password. The provided information does not specify a workaround or mitigation beyond addressing the affected versions.