← Back

CVE-2026-24007

nvd nist
Published: Feb 2, 2026Modified: Feb 23, 2026

JSON object

Loading...
4.6
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Exploitability: 2.1 / Impact: 2.5
Source: security-advisories@github.com (Secondary)

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

Affected (4)

Products: Enalean: Tuleap
Enalean
1 product
Tuleap
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Enalean
Tuleap
Before 17.0.99.1768924735
Tuleap
Before 17.0-9
Tuleap
From 17.1 to 17.1-6
Tuleap
From 17.2 to 17.2-5

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Broken Link
Source: security-advisories@github.com
Issue Tracking

Timeline

No history available yet.