MajorCritical vulnerability

CVE-2026-105411 (CVSS 8.1)

NVD · officialPublished Oct 12, 2026Risk 37/100

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.

Technical details

CVSS

8.1

AV:NetworkAC:LowPR:LowUI:NoneC:NoneI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source