Tuleap manque de protection CSRF dans les éléments incohérents de la vue d'ensemble

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of Tuleap's data and configuration. An attacker could craft malicious links or embed requests within legitimate websites to exploit this flaw. Successful exploitation could lead to the creation of artifact links from releases without proper authorization, potentially introducing malicious code or misrepresenting project status. While the direct impact might seem limited to artifact management, it could be leveraged to gain a deeper understanding of the software development process or even disrupt workflows within the Tuleap environment. The blast radius depends on the level of access granted to users within Tuleap; users with higher privileges could cause more significant damage.

Organizations utilizing Tuleap for software development and collaboration are at risk, particularly those relying on older, unpatched versions. Shared hosting environments where multiple users share the same Tuleap instance are also at increased risk, as an attacker could potentially exploit the vulnerability through a compromised user account.

• php: Examine Tuleap application logs for unusual requests related to artifact link creation or inconsistent item repair. Look for POST requests originating from external domains or with unexpected parameters.

grep -i 'artifact link|inconsistent item' /var/log/apache2/access.log

• generic web: Monitor Tuleap's access logs for requests containing suspicious parameters or originating from unusual IP addresses. Use a WAF to detect and block requests with CSRF tokens that do not match the expected format.

curl -I <tuleap_url>/repair_inconsistent_items.php | grep -i 'csrf-token'

• php: Review Tuleap's code base for instances where user input is used to construct URLs or execute database queries without proper validation or sanitization. Search for functions like header() or redirect() that might be vulnerable to CSRF attacks.

1. 2026-02-02Disclosure

   disclosure

1. Réservé2026-01-19
2. Publiée2026-02-02
3. Modifiée2026-02-03
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-24007 is to upgrade Tuleap to a patched version. Upgrade to Tuleap Community Edition 17.0.99.1768924735 or Enterprise Editions 17.2-5, 17.1-6, and 17.0-9. If an immediate upgrade is not feasible, consider implementing stricter input validation and output encoding within Tuleap's application code to reduce the attack surface. While a WAF or proxy cannot directly prevent CSRF, it can be configured to filter suspicious requests based on patterns associated with known CSRF attack vectors. Regularly review Tuleap's access control policies to ensure users only have the necessary permissions to perform their tasks. After the upgrade, confirm the vulnerability is resolved by attempting to trigger the inconsistent item repair functionality with a crafted CSRF request and verifying that the action is blocked.