CVE-2025-59040

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-59040

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59040.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-59040

Aliases

GHSA-67xc-39v9-pffg

Published

2025-09-18T14:28:41.999Z

Modified

2026-04-10T05:32:22.604249Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Tuleap backlog item representations do not verify the permissions of the child trackers

Details

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-280"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59040.json"
}

References

Affected packages

Git / github.com/enalean/tuleap

Affected ranges

Type: GIT
Repo: https://github.com/enalean/tuleap
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

92e4aa2d830a624a9183206c1c3558b90b8a5525

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59040.json"