CVE-2025-65962 Overview
CVE-2025-65962 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Tuleap, an open source suite for software development management and collaboration developed by Enalean. The flaw affects Tuleap Community Edition versions prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9. The tracker field dependencies feature lacks CSRF protection, allowing attackers to modify tracker field dependencies when an authenticated administrator visits a malicious page.
Critical Impact
Attackers can trick authenticated Tuleap users into unknowingly modifying tracker field dependencies, corrupting project workflows and data integrity.
Affected Products
- Tuleap Community Edition prior to 17.0.99.1763803709
- Tuleap Enterprise Edition prior to 17.0-4
- Tuleap Enterprise Edition prior to 16.13-9
Discovery Timeline
- 2025-12-09 - CVE-2025-65962 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65962
Vulnerability Analysis
The vulnerability resides in Tuleap's tracker field dependencies management interface. Tracker fields define custom workflows and data collection rules for projects, and field dependencies control how selecting one value affects the availability of others. The endpoints responsible for modifying these dependencies do not validate anti-CSRF tokens on state-changing requests.
An attacker can craft an HTML page containing a form or automatic request targeting the vulnerable Tuleap endpoint. When an authenticated Tuleap user visits the attacker-controlled page, the browser submits the request with the user's session cookies. Tuleap accepts the request as legitimate and applies the modifications.
The attack requires user interaction, which limits mass exploitation. However, targeted phishing against Tuleap administrators or project managers can produce reliable results. The impact is limited to integrity of tracker field data, not confidentiality or availability of the wider system.
Root Cause
The root cause is the absence of CSRF token validation on the tracker field dependencies endpoints. Web applications must verify that state-changing requests originate from their own interface by validating a token bound to the user session. Tuleap enforces this pattern in most areas, but the field dependencies handler omitted the check.
Attack Vector
Exploitation occurs over the network without authentication on the attacker's side. The attacker sends a link or embeds a request in a page the victim visits. The victim must have an active authenticated session in Tuleap with rights to modify tracker configurations. No privileges are required on the attacker's part beyond the ability to deliver a URL to the victim.
The fix, committed in 26678c5b411042e68964b199bf88a44607550633, adds CSRF token verification to the affected handlers. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2025-65962
Indicators of Compromise
- Unexpected modifications to tracker field dependencies in project audit logs
- HTTP referer headers pointing to external or unknown domains preceding tracker configuration changes
- Configuration changes performed outside normal working hours or by users who do not typically modify tracker settings
Detection Strategies
- Review Tuleap application logs for POST requests to tracker field dependency endpoints and correlate with the HTTP Referer and Origin headers.
- Monitor tracker audit trails for changes to field dependency rules and compare against approved change tickets.
- Deploy web application firewall rules that flag requests to Tuleap administration endpoints with mismatched origin headers.
Monitoring Recommendations
- Enable and forward Tuleap access and audit logs to a centralized log platform for long-term retention and correlation.
- Alert on tracker field dependency modifications performed by any user account within a short window of that user visiting an external site.
- Track the version banner reported by Tuleap instances to confirm patched versions are deployed across all environments.
How to Mitigate CVE-2025-65962
Immediate Actions Required
- Upgrade Tuleap Community Edition to version 17.0.99.1763803709 or later.
- Upgrade Tuleap Enterprise Edition to 17.0-4 or 16.13-9, depending on your maintenance branch.
- Review recent tracker field dependency changes and revert any unauthorized modifications.
Patch Information
Enalean has released fixes in Tuleap Community Edition 17.0.99.1763803709, Tuleap Enterprise Edition 17.0-4, and Tuleap Enterprise Edition 16.13-9. The upstream fix is available in commit 26678c5b411042e68964b199bf88a44607550633. See the GitHub Commit Log and the Tuleap Tracker Issue for details.
Workarounds
- Restrict administrative access to Tuleap to trusted networks using firewall rules or VPN gating until patches are applied.
- Instruct users with tracker administration rights to log out of Tuleap when not actively using the application.
- Deploy browser policies or extensions that block third-party requests to internal Tuleap hosts.
# Configuration example: verify installed Tuleap version on RHEL/CentOS
rpm -q tuleap
# Expected output for patched Community Edition:
# tuleap-17.0.99.1763803709-1.el9.noarch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
