What’s Vulnerable › Vulnerabilities

CVE-2025-24029: Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-03 · updated 2026-06-17
• Weakness: CWE-280

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Enalean tuleap: before 16.2-7; before 16.3.99.1737562605; from 16.3 before 16.3-5 — fixed in 16.2-7, 16.3-5, 16.3.99.1737562605

How to fix

Upgrade to a fixed version: Enalean tuleap 16.2-7, 16.3-5, 16.3.99.1737562605. Check the vendor advisory for mitigations.

References

• https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=269cbaa73bac6d1c50674c48c9987263f2b38804
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75
• https://tuleap.net/plugins/tracker/?aid=41476

Get alerted when CVE-2025-24029 or the next vulnerability affects your stack