CVE-2025-27401: Tuleap Filter Deletion Vulnerability

CVE-2025-27401 Overview

CVE-2025-27401 affects Tuleap, an open source suite for software development management and team collaboration. The flaw allows an authenticated user with access to a single tracker to delete report filters across every report on the instance. By repeatedly creating and deleting reports, an attacker cycles through filter identifiers and removes criteria filters belonging to other users and tracker administrators. The resulting loss forces users and administrators to recreate their saved filters. The issue is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Critical Impact
Any authenticated user with access to one tracker can wipe criteria filters from all reports across the entire Tuleap instance.

Affected Products

Enalean Tuleap Community Edition prior to 16.4.99.1740498975
Enalean Tuleap Enterprise Edition prior to 16.4-6
Enalean Tuleap Enterprise Edition prior to 16.3-11

Discovery Timeline

2025-03-04 - CVE-2025-27401 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27401

Vulnerability Analysis

Tuleap's tracker plugin exposes report management endpoints that allow authenticated users to create and delete their own reports. The deletion logic does not sufficiently scope the operation to the current user's report filters. An attacker who can access at least one tracker can issue repeated create and delete cycles against the reports API. Each cycle advances through filter identifiers belonging to unrelated reports and removes them.

The vulnerability is classified under [CWE-440: Expected Behavior Violation]. The underlying weakness is not a direct code execution path, so impact is limited to integrity and availability of saved filters. However, loss of criteria filters disrupts tracker workflows for every user and administrator on the instance.

Root Cause

The deletion routine for tracker reports treats filter records as a shared, loosely-identified resource rather than binding them to the owning report and user. Reusing or recycling filter identifiers during repeated create and delete operations lets the handler affect records outside the attacker's own report scope. The upstream fix, applied in commit 0070fef5c3b27fd402d3232041c6e03f79a84ffd, tightens the ownership check during report deletion.

Attack Vector

Exploitation requires network access to the Tuleap web interface, a valid authenticated account, and read access to at least one tracker. User interaction is required because the attacker must trigger report operations through the application interface or scripted API calls. The attacker scripts a loop that creates a report, deletes it, and repeats, cycling through filter identifiers to purge criteria filters across the instance.

See the GitHub Security Advisory GHSA-3rjf-87rf-h8m9 for the vendor-published description.

Detection Methods for CVE-2025-27401

Indicators of Compromise

Sudden disappearance of criteria filters from multiple tracker reports owned by different users.
User complaints or administrator tickets reporting that saved filters must be recreated after no scheduled change.
Elevated volume of report creation and deletion events originating from a single authenticated account.

Detection Strategies

Review Tuleap application logs for repeated POST and DELETE requests targeting the tracker report endpoints from the same user session.
Correlate report deletion events with subsequent filter loss across unrelated trackers to identify the originating account.
Query the database audit trail for high-frequency inserts and deletes against report filter tables within short time windows.

Monitoring Recommendations

Enable verbose request logging on the Tuleap tracker plugin and ship logs to a centralized SIEM for correlation.
Alert on any single account exceeding a baseline threshold of report create or delete actions per minute.
Monitor the Tuleap advisory feed at tuleap.net for related tracker plugin disclosures.

How to Mitigate CVE-2025-27401

Immediate Actions Required

Upgrade Tuleap Community Edition to 16.4.99.1740498975 or later immediately.
Upgrade Tuleap Enterprise Edition to 16.4-6 or 16.3-11 depending on the installed branch.
Audit recent tracker report activity for abusive create and delete patterns prior to patching.
Back up tracker report and filter configuration tables before applying the update to enable restoration if filters were already removed.

Patch Information

The fix is published in the vendor commit 0070fef5c3b27fd402d3232041c6e03f79a84ffd. Apply the official Tuleap packages shipped by Enalean rather than cherry-picking the patch, to ensure dependent tracker plugin changes are included. Review the GitHub Security Advisory GHSA-3rjf-87rf-h8m9 for release notes.

Workarounds

Restrict tracker access to trusted users until the patched release is deployed.
Disable self-service report creation for low-trust user groups where organizational policy permits.
Increase backup frequency of the Tuleap database so that deleted filters can be restored from a recent snapshot.

bash

# Example upgrade commands for a RHEL-based Tuleap Community installation
sudo yum clean all
sudo yum update tuleap
sudo /usr/share/tuleap/tools/utils/php-launcher.sh \
  /usr/share/tuleap/src/tuleap-cfg.php site-deploy
sudo systemctl restart tuleap.service