CVE-2025-54877CWE-863broken-access-control

CVE-2025-54877

Medium · published August 29, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99.1754050155 and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special and always there fields of accessible artifacts even if the permissions associated with the underlying fields do not allow it. This issue has been fixed in Tuleap Community Edition version 16.10.99.1754050155 and Tuleap Enterprise Edition versions 16.9-8 and 16.10-5.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-08-29T20:15Z
Affected products (3)
ProductVersionsFixed in
enalean/tuleap< 16.9-816.9-8
enalean/tuleap< 16.10.99.175405015516.10.99.1754050155
enalean/tuleap≥ 16.10, < 16.10-516.10-5
References (4)
https://github.com/Enalean/tuleap/commit/b0c1328f96135ee6a3f84d0847be5f843eafa590 · [email protected]https://github.com/Enalean/tuleap/security/advisories/GHSA-m5qc-c3q5-2p29 · [email protected]https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b0c1328f96135ee6a3f84d0847be5f843eafa590 · [email protected]https://tuleap.net/plugins/tracker/?aid=44068 · [email protected]
EPSS history
Timeline
  • 29 AUG 15:07Z
    Tuleap's special and always there fields permissions are not verified in cross-tracker search
    cvelistv5