CVE-2025-30155: Enalean Tuleap Auth Bypass Vulnerability

CVE-2025-30155 Overview

CVE-2025-30155 is an authorization flaw in Tuleap, an open source suite for software development and collaboration management. The Tuleap REST API fails to enforce read permissions on parent trackers, allowing authenticated users to access tracker data they should not see. The issue is categorized as CWE-863: Incorrect Authorization. Enalean fixed the vulnerability in Tuleap Community Edition 16.5.99.1742392651, Tuleap Enterprise Edition 16.5-5, and Tuleap Enterprise Edition 16.4-8.

Critical Impact

An authenticated attacker with low privileges can retrieve information from parent trackers over the network without user interaction, breaking the confidentiality boundary enforced by tracker read permissions.

Affected Products

• Enalean Tuleap Community Edition prior to 16.5.99.1742392651
• Enalean Tuleap Enterprise Edition prior to 16.5-5
• Enalean Tuleap Enterprise Edition prior to 16.4-8

Discovery Timeline

• 2025-03-31 - CVE-2025-30155 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30155

Vulnerability Analysis

Tuleap organizes work items in trackers that can be arranged in hierarchical parent-child relationships. Each tracker carries its own read permissions that define which users or groups can view its artifacts. The REST API exposes endpoints for navigating this hierarchy and retrieving artifact data.

The vulnerability stems from missing permission checks when the REST API resolves parent tracker references. While the API validates access to the requested tracker, it does not re-evaluate read permissions when returning data about a parent tracker in the hierarchy. Users authorized to read a child tracker inherit visibility into parent tracker information they were never granted access to.

This produces an information disclosure condition affecting confidentiality only. Integrity and availability are not impacted, and the attacker must hold a valid authenticated session on the Tuleap instance.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] in the REST API code path that returns parent tracker information. The permission model is defined per tracker, but the API relies on the caller's access to the child tracker as an implicit grant. The fix in commit 0921df3 adds an explicit read permission check against the parent tracker before returning its data.

Attack Vector

Exploitation requires network access to the Tuleap instance and valid low-privilege credentials. An attacker enumerates trackers accessible through their account and issues REST API requests that reference parent trackers in the hierarchy. The API returns parent tracker metadata and artifact fields regardless of whether the caller holds read permissions on those parents.

No user interaction, elevated privileges, or specialized tooling is required beyond a standard HTTP client capable of authenticated REST calls. See the GitHub Security Advisory GHSA-6hr4-h6px-7ppg for additional detail on the affected endpoints.

Detection Methods for CVE-2025-30155

Indicators of Compromise

• REST API requests from authenticated users to tracker endpoints that reference tracker IDs the user has never accessed through the web interface.
• Unusual volume of requests to Tuleap tracker REST endpoints from a single session or API token within a short interval.
• API access patterns that enumerate sequential tracker IDs or traverse parent-child hierarchies programmatically.

Detection Strategies

• Enable Tuleap REST API access logging and correlate accessed tracker IDs against each user's assigned tracker permissions.
• Alert on authenticated users retrieving parent tracker data outside their normal project scope.
• Baseline REST API usage per user and flag deviations that suggest hierarchy enumeration.

Monitoring Recommendations

• Forward Tuleap application and web server logs to a centralized analytics platform for retention and query.
• Track API token issuance and revocation to identify tokens performing anomalous tracker access.
• Monitor for scripted user-agents or non-browser clients issuing large numbers of tracker read requests.

How to Mitigate CVE-2025-30155

Immediate Actions Required

• Upgrade Tuleap Community Edition to 16.5.99.1742392651 or later.
• Upgrade Tuleap Enterprise Edition to 16.5-5 or 16.4-8 depending on the deployed maintenance branch.
• Review REST API access logs for suspicious tracker enumeration since the affected versions were deployed.
• Rotate any API tokens suspected of unauthorized use.

Patch Information

Enalean addressed the flaw in commit 0921df3a1c1aa20fc359b373f001a77c43b1b726, which adds explicit read permission enforcement on parent trackers in the REST API. Tracking details are available in Tuleap Tracker issue 42237. Administrators should apply the fixed Community or Enterprise release matching their support channel.

Workarounds

• No vendor-supplied workaround is documented; upgrading to a patched release is the supported remediation.
• If immediate upgrade is not possible, restrict REST API access at the network perimeter to trusted management hosts.
• Reduce the population of authenticated users on the instance until patching is complete to limit exposure.

# Verify installed Tuleap version before and after upgrade
rpm -q tuleap || dpkg -l | grep tuleap

# Example CentOS/RHEL upgrade path
sudo yum update tuleap
sudo systemctl restart httpd tuleap.service