Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M

CVE-2026-24007Tuleap is missing CSRF protection in the Overview inconsistent items

Medium 4.6

In plain English

A medium-severity cross-site request forgery in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	< 17.0.99.1768924735

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=46389 x_refsource_MISC