CVE-2026-24007: Tuleap Overview CSRF Vulnerability

CVE-2026-24007 Overview

CVE-2026-24007 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Tuleap, an Open Source Suite for management of software development and collaboration. The vulnerability exists due to missing CSRF protection in the Overview inconsistent items functionality. An attacker could exploit this flaw to trick authenticated victims into performing unintended actions, specifically repairing inconsistent items which results in the creation of artifact links from releases.

Critical Impact

Authenticated users can be tricked into performing unauthorized actions on the Tuleap platform, potentially compromising the integrity of artifact links and release management.

Affected Products

• Tuleap Community Edition versions prior to 17.0.99.1768924735
• Tuleap Enterprise Edition versions prior to 17.2-5
• Tuleap Enterprise Edition versions prior to 17.1-6
• Tuleap Enterprise Edition versions prior to 17.0-9

Discovery Timeline

• 2026-02-02 - CVE-2026-24007 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-24007

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). CSRF vulnerabilities occur when a web application fails to verify that a request was intentionally made by the authenticated user. In the case of Tuleap, the Overview inconsistent items feature lacks proper CSRF token validation, allowing attackers to craft malicious requests that authenticated users unknowingly submit.

The attack requires user interaction—specifically, the victim must be logged into Tuleap and visit a malicious website or click a crafted link. When successful, the attack causes the victim's browser to send an unauthorized request to the Tuleap server, which processes the request as if it were legitimately initiated by the user.

Root Cause

The root cause of this vulnerability is the absence of CSRF protection mechanisms (such as anti-CSRF tokens) in the endpoint responsible for repairing inconsistent items within the Overview functionality. Without these protections, the server cannot distinguish between legitimate user-initiated requests and forged requests from malicious sources.

Attack Vector

The attack leverages network-based delivery and requires the attacker to:

1. Craft a malicious web page or email containing a forged request targeting the vulnerable Tuleap endpoint
2. Entice an authenticated Tuleap user to visit the malicious page or click the link
3. The victim's browser automatically sends the forged request along with the user's valid session cookies
4. Tuleap processes the request, repairing inconsistent items and creating artifact links from the release without the user's consent

The vulnerability requires the attacker to have low privileges (authentication is needed for the victim) and relies on user interaction to execute. For detailed technical information about the fix, see the GitHub Security Advisory and the related security patch commit.

Detection Methods for CVE-2026-24007

Indicators of Compromise

• Unexpected artifact link creation from releases that users did not intentionally initiate
• Audit logs showing inconsistent item repairs during unusual time periods or from unexpected IP addresses
• User reports of actions they did not perform within the Overview functionality

Detection Strategies

• Review Tuleap audit logs for unusual patterns of inconsistent item repairs, particularly those occurring shortly after users accessed external links
• Monitor HTTP referrer headers for requests to the inconsistent items endpoint originating from external domains
• Implement web application firewall (WAF) rules to detect and block potential CSRF attack patterns

Monitoring Recommendations

• Enable detailed logging for all artifact link modifications and inconsistent item repairs
• Configure alerts for bulk or rapid succession of inconsistent item repair operations
• Monitor user session activity for requests that lack expected CSRF tokens or have suspicious origins

How to Mitigate CVE-2026-24007

Immediate Actions Required

• Upgrade Tuleap Community Edition to version 17.0.99.1768924735 or later immediately
• Upgrade Tuleap Enterprise Edition to version 17.2-5, 17.1-6, or 17.0-9 depending on your release branch
• Review recent audit logs for any unauthorized artifact link modifications
• Educate users about the risks of clicking unknown links while authenticated to Tuleap

Patch Information

The vulnerability has been fixed in the following versions:

The patch implements proper CSRF token validation for the Overview inconsistent items functionality. Technical details are available in the GitHub commit and the Tuleap tracker issue.

Workarounds

• If immediate patching is not possible, consider temporarily restricting access to the Overview inconsistent items feature
• Implement additional network-level controls to limit exposure of the vulnerable endpoint
• Deploy a Web Application Firewall (WAF) with CSRF protection rules as an interim measure
• Advise users to log out of Tuleap sessions when not actively using the platform

# Verify your Tuleap version after patching
tuleap --version
# Expected output should show version 17.0.99.1768924735 or later for Community Edition