CVE-2026-24007
Unknown Unknown - Not Provided
CSRF Vulnerability in Tuleap Overview Allows Unauthorized Item Modification

Publication date: 2026-02-02

Last updated on: 2026-02-23

Assigner: GitHub, Inc.

Description
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-02
Last Modified
2026-02-23
Generated
2026-06-16
AI Q&A
2026-02-03
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24007
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
enalean tuleap to 17.0.99.1768924735 (exc)
enalean tuleap to 17.0-9 (exc)
enalean tuleap From 17.1 (inc) to 17.1-6 (exc)
enalean tuleap From 17.2 (inc) to 17.2-5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Tuleap is a missing Cross-Site Request Forgery (CSRF) protection in the Overview inconsistent items feature. An attacker could exploit this by tricking a victim into performing unintended actions, specifically repairing inconsistent items by creating artifact links from the release, without the victim's consent.

Impact Analysis

The vulnerability could allow an attacker to manipulate the Tuleap system by causing users to unknowingly repair inconsistent items, potentially leading to unauthorized changes in artifact links. This could affect the integrity of project data and collaboration workflows.

Mitigation Strategies

To mitigate this vulnerability, update Tuleap to the fixed versions: Tuleap Community Edition 17.0.99.1768924735 or Tuleap Enterprise Edition 17.2-5, 17.1-6, or 17.0-9. Applying these updates will restore CSRF protection and prevent attackers from exploiting the inconsistent items overview.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart