CVE-2026-24007: Tuleap is missing CSRF protection in the Overview inconsistent items
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24007?
CVE-2026-24007 is considered a high severity vulnerability due to the lack of CSRF protection, which allows attackers to exploit it for unauthorized actions.
How do I fix CVE-2026-24007?
To fix CVE-2026-24007, update Tuleap to the latest version that implements proper CSRF protection.
Which versions of Tuleap are affected by CVE-2026-24007?
CVE-2026-24007 affects Tuleap Community Edition up to version 17.0.99.1768924735 and Tuleap Enterprise Edition from versions 17.1 and 17.0 up to 17.1-6 and 17.2-5.
What type of attack can exploit CVE-2026-24007?
CVE-2026-24007 can be exploited through CSRF attacks, where an attacker tricks users into executing unwanted actions while authenticated.
Is there a workaround for CVE-2026-24007 before upgrading?
There are no documented workarounds for CVE-2026-24007, so upgrading to a secure version is the recommended action.