CVE-2025-22129 - CVE House
Back to Database
Status published Medium CVE-2025-22129

Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap

Vulnerability Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22129

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field dependencies
Medium 4.6
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger management system
Medium 4.6
CVE-2025-64499
Tuleap is missing CSRF protections for its planning management API
Medium 4.6
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.6
CVE-2025-64497
Tuleap exposes releases for all projects to File Release System project administrators
Medium 6.5

Affected Vendor

Affected Software

tuleap
Vulnerable Versions:
< 16.3.99.1736242932

Timeline

Official Publish: February 3rd, 2025
Last Modified: February 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.