CVE-2025-54877

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-54877

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54877.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-54877

Aliases

GHSA-m5qc-c3q5-2p29

Published

2025-08-29T15:07:54.950Z

Modified

2026-04-10T05:30:10.075789Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Tuleap's special and always there fields permissions are not verified in cross-tracker search

Details

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99.1754050155 and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special and always there fields of accessible artifacts even if the permissions associated with the underlying fields do not allow it. This issue has been fixed in Tuleap Community Edition version 16.10.99.1754050155 and Tuleap Enterprise Edition versions 16.9-8 and 16.10-5.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54877.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/enalean/tuleap

Affected ranges

Type: GIT
Repo: https://github.com/enalean/tuleap
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b0c1328f96135ee6a3f84d0847be5f843eafa590

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54877.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.9-8"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.10.99.1754050155"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "16.10"
            },
            {
                "fixed": "16.10-5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.10.99.1754050155"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.9-8"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.10-5"
            }
        ]
    }
]