CVE-2025-52899: Tuleap Information Disclosure Vulnerability

CVE-2025-52899 Overview

CVE-2025-52899 is a user enumeration vulnerability in Tuleap, an open source suite for software development management and collaboration. The forgot password form in affected versions returns responses that allow unauthenticated attackers to determine whether a given username or email address exists on the platform. This information disclosure weakness is tracked as [CWE-204: Observable Response Discrepancy].

The vulnerability affects Tuleap Community Edition prior to 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2. Enalean has published fixes in the corresponding patched releases.

Critical Impact
Unauthenticated remote attackers can enumerate valid Tuleap accounts through the forgot password endpoint, enabling targeted credential attacks and phishing campaigns.

Affected Products

Enalean Tuleap Community Edition prior to 16.9.99.1750843170
Enalean Tuleap Enterprise Edition prior to 16.8-4
Enalean Tuleap Enterprise Edition prior to 16.9-2

Discovery Timeline

2025-07-29 - CVE-2025-52899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52899

Vulnerability Analysis

The forgot password workflow in Tuleap generates responses that differ depending on whether the submitted identifier corresponds to an existing account. Attackers can submit candidate usernames or email addresses to the endpoint and infer account existence from the response content, timing, or status. This is a classic observable response discrepancy weakness that undermines the confidentiality of the user directory.

The issue is network-reachable and requires no authentication or user interaction. Only account existence is exposed, and integrity and availability of the system remain unaffected. The EPSS probability is 0.289% at the 20.9 percentile, reflecting a low but non-trivial likelihood of near-term exploitation.

Root Cause

The forgot password form implementation returned distinguishable outputs for known and unknown identifiers rather than a uniform response. The upstream fix, applied in commit 5c72d6d253016d38ed472eb7918f772d074ddb07, normalizes the response so the server behaves identically regardless of whether the account exists.

Attack Vector

An unauthenticated attacker submits a list of candidate usernames or email addresses to the public forgot password endpoint. By observing differences in the response, the attacker builds a list of valid accounts. The enumerated list feeds downstream attacks including credential stuffing, password spraying, and targeted phishing against confirmed Tuleap users. No exploit code is required beyond a simple HTTP client, and no public proof-of-concept has been observed at publication.

See the GitHub Security Advisory GHSA-xqf3-xxxf-x3c2 for vendor-supplied technical detail.

Detection Methods for CVE-2025-52899

Indicators of Compromise

High-volume POST requests to the Tuleap forgot password endpoint from a single source IP or narrow IP range
Sequential submissions of usernames or email addresses that follow a dictionary or wordlist pattern
Requests originating from anonymizing proxies, Tor exit nodes, or known scraping infrastructure targeting the account recovery URL

Detection Strategies

Alert on repeated forgot password submissions exceeding a baseline threshold per source address within a short time window
Correlate forgot password activity with subsequent authentication attempts against the same identifiers to detect enumeration-to-credential-stuffing pivots
Inspect web server and reverse proxy logs for unusual User-Agent strings and missing Referer headers on password recovery requests

Monitoring Recommendations

Ingest Tuleap application, web server, and WAF logs into a centralized analytics platform for longitudinal review
Track failed authentication rates immediately following spikes in forgot password traffic
Establish a baseline of legitimate password recovery volume and flag statistical deviations for analyst review

How to Mitigate CVE-2025-52899

Immediate Actions Required

Upgrade Tuleap Community Edition to version 16.9.99.1750843170 or later
Upgrade Tuleap Enterprise Edition to 16.8-4, 16.9-2, or later according to the deployed release train
Review web server and application logs for prior enumeration activity against the forgot password endpoint
Enforce multi-factor authentication on all Tuleap accounts to blunt follow-on credential attacks

Patch Information

Enalean addressed the vulnerability in commit 5c72d6d253016d38ed472eb7918f772d074ddb07. The fix ships in Tuleap Community Edition 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2. Refer to the Enalean commit on GitHub and the Tuleap tracker entry aid=43674 for release notes.

Workarounds

Place a Web Application Firewall in front of Tuleap and rate-limit requests to the forgot password endpoint per source IP
Restrict access to the account recovery URL to trusted network ranges where operationally feasible
Add a CAPTCHA or equivalent bot-mitigation challenge to the forgot password form until upgrade is complete

bash

# Configuration example: nginx rate limit for the forgot password endpoint
limit_req_zone $binary_remote_addr zone=tuleap_pwd:10m rate=5r/m;

server {
    location /account/lost-password.php {
        limit_req zone=tuleap_pwd burst=3 nodelay;
        proxy_pass http://tuleap_backend;
    }
}