CVE-2026-19851: CWE-1393 Use of Default Password in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability (CVE-2026-19851) affects Tuleap Enterprise Edition versions 17.0-1 through 17.5-1. It involves the use of default passwords for user accounts created during XML import, which could enable attackers to access these accounts without authorization. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality and integrity impact, and low availability impact. No known exploits are reported in the wild, and no vendor remediation level or patch information is currently available.

An attacker could gain unauthorized access to user accounts created during XML import by exploiting the use of default passwords. This compromises confidentiality and integrity of affected accounts, potentially allowing unauthorized actions under those accounts. Availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider mitigating risks by reviewing and changing default passwords on imported user accounts and restricting XML import functionality if possible.