PT-2026-5715 · Unknown · Tuleap Community Edition+1

Jmasson + 1 · Publicado 2026-02-02 · Atualizado 2026-02-03 · CVE-2026-24007

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1768924735 Tuleap Enterprise Edition versions 17.2-5, 17.1-6, and 17.0-9

Description Tuleap lacks CSRF protection in the Overview inconsistent items feature. An attacker could exploit this to trick users into creating artifact links from the release by repairing inconsistent items. The vulnerability allows an attacker to perform actions on behalf of an authenticated user without their knowledge.

Recommendations Update Tuleap Community Edition to version 17.0.99.1768924735 or later. Update Tuleap Enterprise Edition to version 17.2-5, 17.1-6, or 17.0-9 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-24007

GHSA-7G48-RWQJ-FFXW

Produtos afetados

Tuleap Community Edition

Tuleap Enterprise Edition

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24007.json · Exploit
• https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 · Correção
• https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24007 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2018517568076554582 · Publicação no Twitter
• https://tuleap.net/plugins/tracker/?aid=46389 · Nota
• https://osv.dev/vulnerability/CVE-2026-24007 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2018709679673614353 · Publicação no Twitter
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 · Nota