Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M
CVE-2025-30155Tuleap does not enforce read permissions on parent trackers in the REST API
Medium 4.3
In plain English
A medium-severity incorrect authorization in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 73.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-6hr4-h6px-7ppg x_refsource_CONFIRM
- https://github.com/Enalean/tuleap/commit/0921df3a1c1aa20fc359b373f001a77c43b1b726 x_refsource_MISC
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0921df3a1c1aa20fc359b373f001a77c43b1b726 x_refsource_MISC
- https://tuleap.net/plugins/tracker/?aid=42237 x_refsource_MISC