PT-2025-13797 · Tuleap · Tuleap

Jmasson + 1 · Published 2025-03-31 · Updated 2025-08-21 · CVE-2025-30155

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.5.99.1742392651 Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8

Description The issue concerns the lack of enforcement of read permissions on parent trackers in the REST API. This affects the management of software developments and collaboration.

Recommendations For Tuleap Community Edition versions prior to 16.5.99.1742392651, update to version 16.5.99.1742392651 or later. For Tuleap Enterprise Edition versions prior to 16.5-5, update to version 16.5-5 or later. For Tuleap Enterprise Edition versions prior to 16.4-8, update to version 16.4-8 or later. As a temporary workaround, consider restricting access to the REST API until a patch is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-30155

GHSA-6HR4-H6PX-7PPG

Affected Products

Tuleap

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30155.json · Exploit
• https://github.com/Enalean/tuleap/commit/0921df3a1c1aa20fc359b373f001a77c43b1b726 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30155 · Security Note
• https://tuleap.net/plugins/tracker/?aid=42237 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30155 · Vendor Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-6hr4-h6px-7ppg · Note
• https://t.me/cvedetector/21616 · Telegram Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0921df3a1c1aa20fc359b373f001a77c43b1b726 · Note
• https://twitter.com/CVEnew/status/1906742928376012826 · Twitter Post
• https://t.me/cveNotify/133125 · Telegram Post
• https://t.me/cvetracker/20360 · Telegram Post