Tuleap has missing CSRF protections in its tracker trigger management system

Successful exploitation of CVE-2025-64760 allows an attacker to craft malicious requests that, when triggered by a legitimate user, can result in the creation or deletion of tracker triggers within Tuleap. Tracker triggers are automated actions that occur when specific events happen within the system, such as sending notifications or updating fields. An attacker could leverage this to disrupt workflows, exfiltrate sensitive data (if triggers are configured to expose it), or even gain unauthorized access to other parts of the Tuleap system depending on trigger configurations. The blast radius is directly tied to the privileges associated with the affected tracker triggers and the data they interact with.

Organizations heavily reliant on Tuleap for software development and collaboration are at risk. Specifically, deployments with complex tracker trigger configurations, or those that have not implemented robust security practices, are more vulnerable. Shared hosting environments running Tuleap are also at increased risk, as they may be more susceptible to cross-site scripting and CSRF attacks.

• php: Examine Tuleap application logs for requests with unusual origins or unexpected parameters. Look for POST requests to trigger creation/deletion endpoints without proper CSRF tokens.

grep -i 'csrf' /var/log/apache2/access.log | grep 'tuleap'

• generic web: Use curl to test for CSRF vulnerabilities on Tuleap endpoints. Attempt to trigger actions without proper authentication or CSRF protection.

curl -v -X POST -d 'trigger_action=delete' https://tuleap.example.com/tracker/trigger/1

• php: Check Tuleap configuration files for any insecure settings related to CSRF protection. Verify that CSRF tokens are properly generated and validated for all sensitive actions.

1. 2025-12-08Disclosure

   disclosure

1. Reserviert2025-11-10
2. Veröffentlicht2025-12-08
3. Geändert2025-12-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-64760 is to upgrade to a patched version of Tuleap. Upgrade Tuleap Community Edition to version 17.0.99.1763126988 or Tuleap Enterprise Edition to version 17.0-3 or 16.13-8. If a direct upgrade is not feasible due to compatibility issues, consider rolling back to a previous, known-good version of Tuleap before the vulnerability was introduced. While a direct fix is preferred, implementing strict Content Security Policy (CSP) headers can help mitigate CSRF attacks by restricting the sources from which scripts can be executed. Monitor Tuleap logs for suspicious activity, particularly requests originating from unexpected sources or with unusual parameters. There are no specific Sigma/YARA rules available for this particular vulnerability at this time.