CVE-2026-105411: Tuleap Enterprise Authorization Bypass Flaw

CVE-2026-105411 Overview

CVE-2026-105411 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in Tuleap Enterprise Edition versions 17.0 through 17.5. The flaw allows an attacker with tracker administration rights on a single tracker to update or delete fields on any tracker across the entire instance. The issue stems from improper validation of user-supplied identifiers used to reference tracker fields. Exploitation requires only low-privileged authenticated access and no user interaction.

Critical Impact
An attacker holding tracker administration rights on one tracker can tamper with field definitions on all other trackers, breaking integrity and availability of project data instance-wide.

Affected Products

Tuleap Enterprise Edition 17.0
Tuleap Enterprise Edition 17.x through 17.5
Deployments where tracker administration is delegated to project members

Discovery Timeline

2026-10-12 - CVE-2026-105411 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-105411

Vulnerability Analysis

Tuleap trackers are configurable issue-tracking structures scoped to individual projects. Administration of a tracker is normally restricted to users granted that specific tracker's administration right. The vulnerable code paths that update or delete tracker fields accept a field identifier from the request without validating that the identifier belongs to a tracker the caller actually administers. As a result, the authorization check succeeds based on possession of any tracker admin role, while the operation targets a field belonging to an unrelated tracker. This is a classic Insecure Direct Object Reference pattern mapped to [CWE-639].

Successful exploitation lets an attacker modify field configurations, change field types or validation rules, or delete fields entirely on trackers outside their administrative scope. The impact on integrity and availability of tracked artifacts is high, while confidentiality is not directly affected.

Root Cause

The root cause is a missing object-ownership check on tracker field identifiers submitted by authenticated users. The server trusts the user-controlled key to resolve the target field and performs the privileged operation without reconciling the field's parent tracker with the caller's effective permissions.

Attack Vector

Exploitation occurs over the network against the Tuleap web interface or its REST API. The attacker authenticates as a user who has tracker administration rights on at least one tracker, then issues field update or delete requests referencing field identifiers belonging to other trackers on the same instance. No user interaction is required, and the attack complexity is low. Technical details are available in the 3DS Security Advisory for CVE-2026-105411.

Detection Methods for CVE-2026-105411

Indicators of Compromise

Tracker field modification or deletion events in Tuleap audit logs performed by a user who does not administer the affected tracker.
Unexpected changes to field types, validation rules, or workflows across multiple trackers in a short time window.
REST API calls to tracker field endpoints referencing field identifiers that cross project or tracker boundaries.

Detection Strategies

Correlate the acting user's tracker administration grants against the parent tracker of each modified field in application logs.
Alert on bursts of PUT or DELETE requests against tracker field endpoints originating from a single session.
Review Tuleap project history for field deletions that coincide with artifact rendering errors reported by end users.

Monitoring Recommendations

Forward Tuleap application and web server logs to a central analytics platform and retain tracker administration events for forensic review.
Baseline normal tracker configuration change volume per administrator and alert on deviations.
Monitor REST API authentication tokens with tracker admin scope for anomalous activity against trackers outside their usual project set.

How to Mitigate CVE-2026-105411

Immediate Actions Required

Upgrade Tuleap Enterprise Edition to a fixed release above 17.5 as published in the vendor advisory.
Audit tracker administration grants and revoke the role from users who do not require it.
Review recent tracker field change history across all projects and restore any unauthorized modifications from backups.

Patch Information

Refer to the 3DS Security Advisory for CVE-2026-105411 for the fixed version and upgrade instructions. The patch enforces that the parent tracker of the targeted field matches a tracker the caller is authorized to administer.

Workarounds

Restrict tracker administration rights to trusted site administrators until the patch can be applied.
Place the Tuleap instance behind an authenticating reverse proxy and limit access to the tracker field REST endpoints to known administrative IP ranges.
Enable detailed request logging on the Tuleap front end to retain evidence for post-incident review.

bash

# Configuration example: identify users with tracker admin rights for review
# Run against the Tuleap database host
mysql -u tuleap -p tuleap -e \
  "SELECT ugroup_id, tracker_id FROM tracker_perm WHERE perm_type='PLUGIN_TRACKER_ADMIN';"