CVE-2026-24007

Tuleap is missing CSRF protection in the Overview inconsistent items

Medium4.6EPSS 0.16%

Published: 2 Feb 2026
Updated: 3 Feb 2026
Reserved: 19 Jan 2026
Assigned by: GitHub_M

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

Scores

CVSS scores of CVE-2026-24007, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	Medium4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
NVDNVD · Analyzed	3.1	Medium4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

EPSS (exploitation in 30 days): 0.16% · top 95% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.

Weakness

CWE-352: Cross-Site Request Forgery (CSRF) (opens in a new tab)All about CWE-352 and its CVEs

Affected products

Enalean · tuleap
- affected < 17.0.99.1768924735

References (4)

https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxw (opens in a new tab)x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 (opens in a new tab)x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5 (opens in a new tab)x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=46389 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-24007](https://trackcve.app/badge/CVE-2026-24007.svg)](https://trackcve.app/cve/CVE-2026-24007)

Record last updated 3 Feb 2026, 14:56 UTC.