CVE-2025-48991 Overview
CVE-2025-48991 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Tuleap, an open source suite for software development management and team collaboration. The flaw affects Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5. An attacker can trick authenticated victims into unknowingly modifying canned responses within the application. Successful exploitation requires user interaction, such as clicking a crafted link while authenticated to Tuleap.
Critical Impact
Attackers can manipulate canned response content by tricking authenticated users into submitting forged requests, undermining data integrity in project trackers.
Affected Products
- Tuleap Community Edition prior to 16.8.99.1748845907
- Tuleap Enterprise Edition prior to 16.8-3
- Tuleap Enterprise Edition prior to 16.7-5
Discovery Timeline
- 2025-06-25 - CVE-2025-48991 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48991
Vulnerability Analysis
CVE-2025-48991 is a Cross-Site Request Forgery weakness in Tuleap's canned responses feature. Canned responses are predefined reply templates used within Tuleap trackers to streamline user communication. The application fails to validate the origin or intent of state-changing requests that modify these responses. An authenticated user visiting a malicious page can have their browser submit forged requests to the Tuleap instance. The server processes these requests as legitimate actions performed by the victim.
The vulnerability requires user interaction and does not disclose confidential data, but it enables unauthorized modification of tracker configuration. The impact is limited to integrity of canned response content. No privileges are required by the attacker beyond enticing an authenticated user to trigger the request.
Root Cause
The root cause is the absence of adequate anti-CSRF protection on the endpoints responsible for updating canned responses. Without a per-request token bound to the user session, the application cannot distinguish between requests initiated by the legitimate user interface and requests forged by an external attacker-controlled page. The fix, delivered in commit cbf9b2a38e33dfd755dc2ccf074126b598a78274, enforces CSRF token validation on these actions. See the GitHub Security Advisory GHSA-px9r-875r-w534 for details.
Attack Vector
Exploitation is network-based and follows a standard CSRF pattern. The attacker crafts a web page or email containing HTML or JavaScript that automatically submits a POST request to the vulnerable Tuleap endpoint. When an authenticated Tuleap user loads the malicious content, their browser attaches session cookies and the request executes with the victim's privileges. The canned response is silently modified without any indication to the victim.
Refer to the Tuleap Tracker Reference 43326 for the vendor's technical description of the flaw.
Detection Methods for CVE-2025-48991
Indicators of Compromise
- Unexpected modifications to canned response content within tracker configurations.
- HTTP POST requests to canned response administration endpoints originating from external Referer headers.
- Audit log entries showing canned response changes at unusual times or by users who did not intentionally perform the action.
Detection Strategies
- Review Tuleap audit trails and web server access logs for requests to canned response management endpoints with cross-origin Referer or Origin headers.
- Correlate user session activity with canned response modifications to identify actions inconsistent with normal user workflow.
- Deploy web application firewall rules that alert on state-changing requests missing valid anti-CSRF tokens.
Monitoring Recommendations
- Enable and centralize Tuleap application logs to capture configuration changes to trackers and canned responses.
- Monitor for anomalous outbound traffic from user workstations to Tuleap immediately after users visit untrusted external sites.
- Alert on any modification to canned response objects performed outside of expected maintenance windows or by non-administrative accounts.
How to Mitigate CVE-2025-48991
Immediate Actions Required
- Upgrade Tuleap Community Edition to version 16.8.99.1748845907 or later.
- Upgrade Tuleap Enterprise Edition to 16.8-3 or 16.7-5, depending on the deployed release branch.
- Audit canned responses across all trackers to verify integrity and revert any unauthorized changes.
Patch Information
The vendor released the fix in commit cbf9b2a38e33dfd755dc2ccf074126b598a78274, available through the GitHub Commit and the Tuleap Git Commit Reference. Administrators should apply the corresponding packaged release for their edition.
Workarounds
- Restrict access to the Tuleap instance to trusted networks using VPN or IP allowlisting until patching completes.
- Instruct privileged users to log out of Tuleap sessions before browsing untrusted sites, reducing the CSRF window.
- Configure browser session cookies with SameSite=Strict at the reverse proxy where feasible to limit cross-site request delivery.
# Configuration example - refer to vendor advisory for authoritative upgrade steps
# See: https://github.com/Enalean/tuleap/security/advisories/GHSA-px9r-875r-w534
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
