CVE-2024-46988: Tuleap does not properly check permissions for email notifications in trackers

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-14 · updated 2026-06-17
Weakness: CWE-280

Description

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notification with information they should not have access to. Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.

Affected products

Enalean tuleap: before 15.12-6; before 15.13.99.40; from 15.13-0 before 15.13-3 — fixed in 15.12-6, 15.13-3, 15.13.99.40

How to fix

Upgrade to a fixed version: Enalean tuleap 15.12-6, 15.13-3, 15.13.99.40. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-46988 or the next vulnerability affects your stack