CVE-2026-105411
Received Received - Intake

Authorization Bypass in Tuleap Enterprise Edition

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Dassault Systèmes

Description
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-105411
EUVD
EUVD-2026-97331

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Dassault Systèmes Tuleap Enterprise Edition 17.0-1
Dassault Systèmes Tuleap Enterprise Edition 17.5-1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Authorization Bypass Through User-Controlled Key vulnerability in Tuleap Enterprise Edition versions 17.0 through 17.5. It allows an attacker with tracker administration rights on one tracker to update or delete fields across all trackers in the same instance.

Impact Analysis

An attacker could exploit this to modify or delete critical data across all trackers, potentially disrupting operations, corrupting records, or causing data loss. This could affect project management, issue tracking, and collaboration within the Tuleap instance.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or deletions, violating integrity and access control requirements in GDPR and HIPAA. Non-compliance risks include fines, legal penalties, and reputational damage due to compromised data.

Mitigation Strategies

Apply remediation measures provided by Dassault Systèmes for Tuleap Enterprise Edition versions 17.0 through 17.5. Ensure tracker administration rights are restricted to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart