Vulnerability · Published Dec 8, 2025 · Assigned by GitHub_M

CVE-2025-64497Tuleap exposes releases for all projects to File Release System project administrators

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	Tuleap Community Edition < 17.0.99.1762431347Tuleap Enterprise Edition < 17.0-2Tuleap Enterprise Edition < 16.13-7Tuleap Enterprise Edition < 16.12-10

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254 x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254 x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=45583 x_refsource_MISC