PT-2025-38408 · Unknown · Tuleap Community Edition+1

Lesuisse · Published 2025-09-18 · Updated 2025-09-18 · CVE-2025-59040

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 16.11.99.1757427600 Tuleap Enterprise Edition versions prior to 16.11-6 Tuleap Enterprise Edition version 16.10-8

Description Backlog item representations do not verify the permissions of child trackers, potentially allowing users to view tracker names they should not have access to.

Recommendations Update Tuleap Community Edition to version 16.11.99.1757427600. Update Tuleap Enterprise Edition to version 16.11-6. Update Tuleap Enterprise Edition to version 16.10-8.

Exploit

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2025-59040

GHSA-67XC-39V9-PFFG

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59040.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59040 · Security Note
• https://github.com/Enalean/tuleap/commit/92e4aa2d830a624a9183206c1c3558b90b8a5525 · Note
• https://github.com/Enalean/tuleap/security/advisories/GHSA-67xc-39v9-pffg · Note
• https://twitter.com/CVEnew/status/1968718091862564928 · Twitter Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=92e4aa2d830a624a9183206c1c3558b90b8a5525 · Note
• https://tuleap.net/plugins/tracker/?aid=44489 · Note