A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user… (CVE-2026-19851)

This vulnerability (CVE-2026-19851) affects Tuleap Enterprise Edition versions from 17.0 through 17.5. It involves the use of default passwords for user accounts created during XML import, which could allow an attacker to gain unauthorized access to those accounts. The CVSS 3.1 score is 7.7, indicating a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity significantly with a low impact on availability.

An attacker can gain unauthorized access to user accounts created during XML import, potentially compromising sensitive information and altering data integrity. The impact on availability is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using XML import features that create user accounts with default passwords or manually change default passwords immediately after import.