CVE-2026-105411: CWE-639 Authorization Bypass Through User-Controlled Key in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability (CWE-639) in Tuleap Enterprise Edition enables an attacker who has tracker administration privileges on a single tracker to bypass authorization controls and modify or delete fields across all trackers within the instance. The flaw arises from improper authorization checks related to user-controlled keys. The affected versions are from 17.0-1 up to and including 17.0-41, and from 17.5-1 up to and including 17.5-32. The CVSS v3.1 score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts on integrity and availability.

An attacker with limited administrative rights on one tracker can escalate their privileges to modify or delete fields in all trackers on the Tuleap instance. This can lead to unauthorized changes affecting data integrity and availability of the tracking system. Confidentiality is not impacted according to the CVSS vector.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict tracker administration rights to trusted users only to minimize risk.