Platform
php
Component
tuleap
Fixed in
17.0.100
CVE-2026-24007 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in Tuleap, an open-source software suite for managing software development and collaboration. This flaw allows an attacker to potentially manipulate Tuleap's functionality by tricking authenticated users into performing unintended actions, specifically related to repairing inconsistent items and creating artifact links. The vulnerability affects versions of Tuleap up to and including 17.0.99.1768924735, with fixes available in later releases.
The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of Tuleap's data and configuration. An attacker could craft malicious links or embed requests within legitimate websites to exploit this flaw. Successful exploitation could lead to the creation of artifact links from releases without proper authorization, potentially introducing malicious code or misrepresenting project status. While the direct impact might seem limited to artifact management, it could be leveraged to gain a deeper understanding of the software development process or even disrupt workflows within the Tuleap environment. The blast radius depends on the level of access granted to users within Tuleap; users with higher privileges could cause more significant damage.
CVE-2026-24007 was publicly disclosed on 2026-02-02. There is currently no indication of active exploitation or a KEV listing. No public proof-of-concept (PoC) code has been released. The vulnerability's CVSS score of 4.6 (MEDIUM) suggests a moderate probability of exploitation, particularly if attackers gain access to users' Tuleap sessions or can trick them into clicking malicious links.
Exploit Status
EPSS
0.01% (0% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-24007 is to upgrade Tuleap to a patched version. Upgrade to Tuleap Community Edition 17.0.99.1768924735 or Enterprise Editions 17.2-5, 17.1-6, and 17.0-9. If an immediate upgrade is not feasible, consider implementing stricter input validation and output encoding within Tuleap's application code to reduce the attack surface. While a WAF or proxy cannot directly prevent CSRF, it can be configured to filter suspicious requests based on patterns associated with known CSRF attack vectors. Regularly review Tuleap's access control policies to ensure users only have the necessary permissions to perform their tasks. After the upgrade, confirm the vulnerability is resolved by attempting to trigger the inconsistent item repair functionality with a crafted CSRF request and verifying that the action is blocked.
Update Tuleap to version 17.0.99.1768924735 or higher. This will correct the CSRF vulnerability in the management of inconsistent items. The update can be performed through the Tuleap administration panel or by following the upgrade instructions provided by the vendor.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-24007 is a Cross-Site Request Forgery (CSRF) vulnerability in Tuleap versions up to 17.0.99.1768924735, allowing attackers to trick users into performing unauthorized actions like creating malicious artifact links.
You are affected if you are using Tuleap versions prior to 17.0.99.1768924735, including Community and Enterprise editions.
Upgrade to Tuleap Community Edition 17.0.99.1768924735 or Enterprise Editions 17.2-5, 17.1-6, and 17.0-9. Consider implementing stricter input validation as a temporary workaround.
There is currently no evidence of active exploitation, but the vulnerability's CVSS score indicates a moderate risk.
Refer to the official Tuleap security advisories on their website for the most up-to-date information and guidance.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.