CVE-2025-59040 - CVE House
Back to Database
Status published Medium CVE-2025-59040

Tuleap backlog item representations do not verify the permissions of the child trackers

Vulnerability Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59040

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field dependencies
Medium 4.6
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger management system
Medium 4.6
CVE-2025-64499
Tuleap is missing CSRF protections for its planning management API
Medium 4.6
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.6
CVE-2025-64497
Tuleap exposes releases for all projects to File Release System project administrators
Medium 6.5

Affected Vendor

Affected Software

tuleap
Vulnerable Versions:
< 16.11.99.1757427600

Timeline

Official Publish: September 18th, 2025
Last Modified: September 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.