CVE-2026-24007VulnerabilityPublished 2 Feb 2026

CVE-2026-24007: Enalean tuleap · Cross-Site Request Forgery (CSRF)

Affects Enalean tuleapSource CVE Database V5

Not known to be exploited · CVSS 4.6 Medium : upgrade to 17.0.99.1768924735 when convenient.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

4.6Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 17.0.99.1768924735

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade tuleap and enalean/tuleap to 17.0.99.1768924735.

Affected software

Product	Affected	Fixed in
Enaleantuleap	Affected <17.0.99.1768924735	Fixed in 17.0.99.1768924735
GitHubenalean/tuleap`pkg:github/enalean/tuleap`Other threats	Affected <17.0.99.1768924735	Fixed in 17.0.99.1768924735

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Organizations should immediately upgrade Tuleap installations to the fixed versions: Community Edition 17.0.99.1768924735 or Enterprise Editions 17.2-5, 17.1-6, or 17.0-9. If you cannot patch yet, administrators should implement additional CSRF mitigations such as enforcing strict SameSite cookie attributes and validating origin headers where feasible. User education to recognize phishing attempts and suspicious links is critical to reduce the risk of social engineering-based exploitation. Monitoring and logging of unusual repair actions or artifact link creations can help detect attempted exploitation. Network-level protections, such as web application firewalls (WAFs), can be configured to detect and block suspicious CSRF-like requests targeting the vulnerable endpoints. Regular security audits and vulnerability scans should be conducted to ensure no outdated versions remain in use. Finally, organizations should review and tighten user privilege assignments to minimize the number of users with permissions to perform repair actions, reducing the attack surface.

Description

CVE-2026-24007 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Enalean's Tuleap software versions prior to 17.0.99.1768924735. The flaw exists in the 'Overview inconsistent items' functionality, where missing CSRF protections allow attackers to trick authenticated users into performing unintended actions, specifically repairing inconsistent items by creating artifact links from releases. Exploitation requires the victim to be authenticated and interact with a maliciously crafted request. The vulnerability impacts the integrity and availability of the affected system but does not compromise confidentiality. Fixed versions have been released in both the Community and Enterprise Editions. European organizations using vulnerable Tuleap versions for software development management should prioritize patching to prevent potential misuse. No known exploits are reported in the wild as of now.

Impact

For European organizations relying on Tuleap for software development lifecycle management and collaboration, this vulnerability poses a risk to the integrity and availability of project data. Unauthorized repair of inconsistent items could lead to corrupted project artifacts, mislinked releases, or disrupted workflows, potentially delaying development cycles and causing operational inefficiencies. While confidentiality is not directly impacted, the integrity compromise can undermine trust in project data and may require significant manual remediation. Organizations with strict compliance requirements or those operating in regulated sectors (e.g., finance, healthcare, critical infrastructure) may face additional risks if project data integrity is compromised. The requirement for user interaction and authentication limits the scope somewhat, but social engineering or phishing campaigns could facilitate exploitation. Given Tuleap's adoption in European software development environments, especially in countries with strong open-source communities and digital transformation initiatives, the impact could be significant if unpatched.

Summary

CVE-2026-24007 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Enalean's Tuleap, an open-source software development and collaboration suite. The vulnerability arises due to the absence of CSRF protection in the 'Overview inconsistent items' feature, which manages artifact links related to software releases. CSRF attacks exploit the trust a web application places in a user's browser by tricking authenticated users into submitting unauthorized requests. In this case, an attacker can craft a malicious link or webpage that, when visited by an authenticated Tuleap user, triggers the repair of inconsistent items by creating artifact links without the user's consent. This can lead to unauthorized modifications affecting the integrity of project data and potentially disrupt project workflows, impacting availability. The CVSS v3.1 base score is 4.6 (medium), reflecting that the attack vector is network-based, requires low privileges and user interaction, and impacts integrity and availability but not confidentiality. The vulnerability affects all Tuleap versions prior to 17.0.99.1768924735, with fixes available in the Community Edition 17.0.99.1768924735 and Enterprise Editions 17.2-5, 17.1-6, and 17.0-9. No public exploits have been reported, indicating limited current exploitation but a potential risk if attackers develop exploit code. The vulnerability is classified under CWE-352, a common web security weakness related to CSRF.

CWE-352Cross-Site Request Forgery (CSRF) (opens in a new tab)
Compound weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #3OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
OWASP Cheat Sheets
REST Assessment (opens in a new tab)
REST Security (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
Authorization Testing Automation (opens in a new tab)
Insecure Direct Object Reference Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.2.3 (opens in a new tab)
V4.2.2 (opens in a new tab)
V13.3.2 (opens in a new tab)
Attack patterns
JSON Hijacking (aka JavaScript Hijacking) (opens in a new tab)
Cross-Domain Search Timing (opens in a new tab)
Cross Site Identification (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Feb 2026, 11:13 UTC

WeaknessesCWE-352

Technical details

References

Community reviews

Related threats