CVE-2025-30209: Enalean Tuleap Info Disclosure Flaw

CVE-2025-30209 Overview

CVE-2025-30209 is an authorization flaw in Tuleap, an open source suite for managing software development and collaboration. The vulnerability allows an unauthenticated attacker to access release notes content and related information through the File Release System (FRS) REST endpoints without proper authorization checks. The issue is classified under [CWE-863: Incorrect Authorization] and affects both Community and Enterprise editions of the platform. Enalean has released fixes in Tuleap Community Edition 16.5.99.1742812323, Tuleap Enterprise Edition 16.5-6, and Tuleap Enterprise Edition 16.4-10.

Critical Impact
Attackers can retrieve release notes and FRS metadata they should not be permitted to view, exposing confidential project information through network-accessible REST endpoints.

Affected Products

Enalean Tuleap Community Edition prior to 16.5.99.1742812323
Enalean Tuleap Enterprise Edition prior to 16.5-6
Enalean Tuleap Enterprise Edition prior to 16.4-10

Discovery Timeline

2025-03-31 - CVE-2025-30209 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30209

Vulnerability Analysis

The vulnerability resides in Tuleap's File Release System (FRS) REST API endpoints. These endpoints return release notes content and related file release metadata to clients. The authorization logic fails to correctly enforce access controls on the requested resources. As a result, unauthorized network callers can query the API and retrieve data intended only for users with valid permissions on the target project or release.

The flaw is a confidentiality issue only. It does not permit modification of release data or affect service availability. However, release notes frequently contain internal project details, roadmap information, bug references, and security fix descriptions that were expected to remain restricted.

Root Cause

The root cause is an incorrect authorization check in the FRS REST endpoint handlers. The endpoints did not consistently validate that the requesting principal held the permissions required to view the underlying release or its notes. The fix commit 34af2d5d10b0349967129f53427f495815e5bbcc corrects the permission enforcement path. Additional context is available in the Tuleap GitHub Security Advisory GHSA-hcp5-pmpm-mgwh.

Attack Vector

An attacker sends crafted HTTP requests to the affected FRS REST endpoints over the network. No authentication or user interaction is required, and attack complexity is low. Successful requests return release note content and metadata the caller is not authorized to see. The vulnerability is described in detail in the Tuleap Tracker Reference.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.35% (percentile 27.098).

Detection Methods for CVE-2025-30209

Indicators of Compromise

Unexpected HTTP GET requests to Tuleap FRS REST endpoints (paths under /api/frs_*) originating from unauthenticated or low-privilege sessions.
Successful 200 OK responses returning release note payloads to clients that do not have project membership on the referenced project.
High-volume enumeration of sequential release or package identifiers via the FRS API.

Detection Strategies

Review Tuleap access logs for FRS REST endpoint calls correlated with anonymous or non-member users, and compare requested resource IDs against project membership.
Deploy a web application firewall rule to flag repeated FRS API queries from a single source that iterate through numeric identifiers.
Ingest Tuleap application logs into a centralized SIEM and alert on FRS endpoint responses that return content to sessions without an authenticated principal.

Monitoring Recommendations

Enable verbose HTTP access logging on the Tuleap reverse proxy and retain logs for at least 90 days to support retrospective review.
Track baseline request rates for FRS endpoints and alert on deviations that suggest scripted enumeration.
Audit REST API tokens and anonymous access settings to confirm they align with project confidentiality requirements.

How to Mitigate CVE-2025-30209

Immediate Actions Required

Upgrade Tuleap Community Edition to 16.5.99.1742812323 or later without delay.
Upgrade Tuleap Enterprise Edition to 16.5-6 or 16.4-10 on the corresponding maintenance branch.
Review historical access logs on the FRS REST endpoints for signs of unauthorized data retrieval prior to patching.

Patch Information

Enalean addressed the issue in commit 34af2d5d10b0349967129f53427f495815e5bbcc. Details are available in the Enalean/tuleap GitHub commit and the Tuleap upstream commit reference. Administrators should apply the vendor-supplied packages for their edition rather than back-porting the commit manually.

Workarounds

Restrict network access to the Tuleap REST API using a reverse proxy or firewall until patches are applied, allowing only trusted client networks.
Disable anonymous access to projects that contain sensitive release note content.
If REST access is not required, disable or block the FRS REST endpoints at the ingress layer as a temporary control.

bash

# Example nginx rule to temporarily block anonymous FRS REST calls
location ~* ^/api/(frs_files|frs_packages|frs_release) {
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://tuleap_backend;
}