PT-2026-5715 · Unknown · Tuleap Community Edition+1

Jmasson + 1 · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-24007

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1768924735 Tuleap Enterprise Edition versions 17.2-5, 17.1-6, and 17.0-9

Description Tuleap lacks CSRF protection in the Overview inconsistent items feature. An attacker could exploit this to trick users into creating artifact links from the release by repairing inconsistent items. The vulnerability allows an attacker to perform actions on behalf of an authenticated user without their knowledge.

Recommendations Update Tuleap Community Edition to version 17.0.99.1768924735 or later. Update Tuleap Enterprise Edition to version 17.2-5, 17.1-6, or 17.0-9 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-24007

GHSA-7G48-RWQJ-FFXW

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24007.json · Exploit
• https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24007 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24007 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2018517568076554582 · Twitter Post
• https://tuleap.net/plugins/tracker/?aid=46389 · Note
• https://twitter.com/CVEnew/status/2018709679673614353 · Twitter Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 · Note