CVE-2026-24007

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24007", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.660Z", "datePublished": "2026-02-02T19:52:51.336Z", "dateUpdated": "2026-02-03T14:56:49.087Z"}, "containers": {"cna": {"title": "Tuleap is missing CSRF protection in the Overview inconsistent items", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw"}, {"name": "https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "tags": ["x_refsource_MISC"], "url": "https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5"}, {"name": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5"}, {"name": "https://tuleap.net/plugins/tracker/?aid=46389", "tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/tracker/?aid=46389"}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"version": "< 17.0.99.1768924735", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T19:52:51.336Z"}, "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9."}], "source": {"advisory": "GHSA-7g48-rwqj-ffxw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T14:55:54.302031Z", "id": "CVE-2026-24007", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T14:56:49.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T14:55:54.302031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T14:56:43.872Z"}}], "cna": {"title": "Tuleap is missing CSRF protection in the Overview inconsistent items", "source": {"advisory": "GHSA-7g48-rwqj-ffxw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"status": "affected", "version": "< 17.0.99.1768924735"}]}], "references": [{"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw", "name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "name": "https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "tags": ["x_refsource_MISC"]}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "name": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5", "tags": ["x_refsource_MISC"]}, {"url": "https://tuleap.net/plugins/tracker/?aid=46389", "name": "https://tuleap.net/plugins/tracker/?aid=46389", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T19:52:51.336Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24007", "state": "PUBLISHED", "dateUpdated": "2026-02-03T14:56:49.087Z", "dateReserved": "2026-01-19T18:49:20.660Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T19:52:51.336Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tuleap", "vendor": "Enalean", "versions": [{"status": "affected", "version": "< 17.0.99.1768924735"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "72563F4A-1F81-4973-A289-F0F6E8E7CBF8", "versionEndExcluding": "17.0-9", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "matchCriteriaId": "7ABF04A7-567F-45EB-BBC6-6A8AAB31DFD8", "versionEndExcluding": "17.0.99.1768924735", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F6DEB940-5662-4074-AC3E-237C357E0418", "versionEndExcluding": "17.1-6", "versionStartIncluding": "17.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C108E674-7031-46E8-A3E0-9378CEE62A17", "versionEndExcluding": "17.2-5", "versionStartIncluding": "17.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto para la gesti\u00f3n de desarrollo de software y colaboraci\u00f3n. Tuleap carece de protecci\u00f3n CSRF en los elementos inconsistentes de la Vista general. Un atacante podr\u00eda usar esta vulnerabilidad para enga\u00f1ar a las v\u00edctimas para que reparen elementos inconsistentes (creando enlaces de artefactos desde la versi\u00f3n). Esta vulnerabilidad est\u00e1 corregida en Tuleap Community Edition 17.0.99.1768924735 y Tuleap Enterprise Edition 17.2-5, 17.1-6 y 17.0-9."}], "id": "CVE-2026-24007", "lastModified": "2026-06-17T10:22:28.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24007", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T14:55:54.302031Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:07.500", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw"}, {"source": "security-advisories@github.com", "tags": ["Broken Link"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://tuleap.net/plugins/tracker/?aid=46389"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:35:59.931708+00:00", "value": {"mitigation_remediation": ["Upgrade Tuleap to Community Edition 17.0.99.1768924735 or later, or Enterprise Edition 17.2\u20115, 17.1\u20116, or 17.0\u20119 and newer", "If an upgrade is not feasible, disable the Overview inconsistent items feature or restrict user permissions for artifact link creation", "Educate users on phishing tactics and implement CSRF token verification checks to mitigate inadvertent exploitation"], "summary": {"action": "Apply Patch", "impact": "Unauthorized artifact link creation via CSRF"}, "threat_synthesis": {"affected_systems": "Enalean Tuleap Community Edition 17.0.99.1768924735 and newer, and Enterprise Editions 17.2\u20115, 17.1\u20116, or 17.0\u20119 and newer are fixed; all earlier releases across community and enterprise distributions remain susceptible.", "description_and_impact": "The flaw is a missing CSRF protection on the Overview inconsistent items interface, allowing an attacker to trick a user into resolving item inconsistencies while simultaneously creating new artifact links from a release. This alters project data without the user\u2019s intent and is a classic Cross\u2011Site Request Forgery (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 4.6 classifies the vulnerability as moderate, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. It is not listed in CISA\u2019s KEV catalog. Exploitation would require a victim to click a malicious link or form, implying a user\u2011interaction vector that an attacker typically achieves through phishing or social engineering. The potential impact of unauthorized link creation could disrupt release workflows and data integrity, justifying prompt remediation."}}}}, "created": "2026-02-04T12:17:55.342838+00:00", "updated": "2026-04-18T18:45:05.753113+00:00", "vendors": ["enalean", "enalean$PRODUCT$tuleap"]}