CVE-2025-29766: Enalean Tuleap CSRF Vulnerability

CVE-2025-29766 Overview

CVE-2025-29766 is a Cross-Site Request Forgery (CSRF) vulnerability in Tuleap, an open source suite for software development management and collaboration. The vulnerability stems from missing CSRF protections on artifact submission and editing from the tracker view. Attackers can trick authenticated victims into submitting or editing artifacts and follow-up comments without their consent. The flaw is tracked as [CWE-352] and affects both Tuleap Community Edition and Tuleap Enterprise Edition. Enalean fixed the issue in Tuleap Community Edition 16.5.99.1741784483, Tuleap Enterprise Edition 16.5-3, and Tuleap Enterprise Edition 16.4-8.

Critical Impact
Successful exploitation allows attackers to submit or modify tracker artifacts and follow-up comments under the identity of an authenticated victim, compromising data integrity in project management workflows.

Affected Products

Enalean Tuleap Community Edition (prior to 16.5.99.1741784483)
Enalean Tuleap Enterprise Edition 16.5 (prior to 16.5-3)
Enalean Tuleap Enterprise Edition 16.4 (prior to 16.4-8)

Discovery Timeline

2025-03-31 - CVE-2025-29766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29766

Vulnerability Analysis

The vulnerability exists in the Tuleap tracker view where artifact submission and editing endpoints lack Cross-Site Request Forgery protection tokens. Trackers in Tuleap represent structured records used to manage issues, tasks, and requirements. Without CSRF tokens validating the origin of state-changing requests, the application accepts forged requests that arrive with the victim's session cookies. An attacker crafts a malicious page that triggers a request to the tracker artifact endpoint. When an authenticated Tuleap user visits the attacker-controlled page, the browser automatically submits session credentials with the forged request.

Root Cause

The root cause is missing CSRF token validation on artifact submission and edition workflows exposed through the tracker view. The affected endpoints processed state-changing HTTP requests without verifying that the request originated from a legitimate Tuleap page. This maps directly to [CWE-352] Cross-Site Request Forgery. The fix, delivered in commit 81f45330fdcc1329cc71eddf4d04b80c340b3b93, introduces CSRF challenge validation on the affected artifact endpoints.

Attack Vector

Exploitation requires an authenticated Tuleap user to visit an attacker-controlled web page or click a crafted link. The malicious page issues an automatic POST request to the victim's Tuleap instance targeting artifact submission or editing endpoints. Because the browser attaches the victim's authenticated session cookies, the request executes with the victim's privileges. Attackers can create fraudulent artifacts, modify existing artifact fields, or inject misleading follow-up comments into tracker items.

See the GitHub Security Advisory GHSA-6p9q-p2q4-3rqx for the vendor's technical description and the upstream commit for the code-level fix.

Detection Methods for CVE-2025-29766

Indicators of Compromise

Unexpected artifact creation or modification events attributed to users who did not intentionally perform the action.
Follow-up comments containing unusual content, external links, or references inconsistent with normal user activity.
HTTP POST requests to tracker artifact endpoints with Referer or Origin headers pointing to domains outside the trusted Tuleap deployment.

Detection Strategies

Review Tuleap audit logs for artifact submissions and edits with mismatched Referer headers relative to the deployment domain.
Correlate authentication session activity with artifact modification events to identify actions triggered from unusual browsing contexts.
Alert on burst patterns of artifact creation or comment updates originating from a single session within short time windows.

Monitoring Recommendations

Enable and centrally collect Tuleap web server access logs, capturing full request headers including Referer and Origin.
Monitor tracker change history for artifacts modified outside normal working hours or by accounts that rarely edit trackers.
Track outbound requests from user endpoints to Tuleap URLs immediately after visits to untrusted external sites.

How to Mitigate CVE-2025-29766

Immediate Actions Required

Upgrade Tuleap Community Edition to 16.5.99.1741784483 or later.
Upgrade Tuleap Enterprise Edition to 16.5-3 or 16.4-8 depending on the deployed release branch.
Instruct Tuleap users to log out of their sessions when not actively using the application, reducing the window for session-riding attacks.

Patch Information

Enalean addressed the vulnerability in commit 81f45330fdcc1329cc71eddf4d04b80c340b3b93, which adds CSRF token validation to the artifact submission and edition endpoints in the tracker view. Details are available in the GitHub Security Advisory and the Tuleap tracker entry aid=42208.

Workarounds

No vendor-supplied workaround is documented; applying the fixed release is the recommended remediation.
As a compensating control, restrict Tuleap access to trusted networks via VPN or IP allowlisting to reduce cross-site exposure.
Configure browsers and reverse proxies to enforce strict SameSite=Lax or SameSite=Strict cookie attributes on Tuleap session cookies where supported.

bash

# Configuration example: enforce SameSite cookie attribute at the reverse proxy
# (nginx example - adjust for your Tuleap deployment)
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";