CVE-2022-31032

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get access to information in those template projects because the permissions model is not properly enforced. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200

• https://docs.tuleap.org/administration-guide/users-management/security/site-access.htmlProduct
• https://github.com/Enalean/tuleap/commit/7e221a9d1893c13407b35008762757a76d8e5654Patch, Third Party Advisory
• https://github.com/Enalean/tuleap/commit/cc38bcc59ce0c733ca915d95daec5f3082fb17caPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hvx6-4228-whj3Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=7e221a9d1893c13407b35008762757a76d8e5654Patch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=26816Issue Tracking, Vendor Advisory
• https://docs.tuleap.org/administration-guide/users-management/security/site-access.htmlProduct
• https://github.com/Enalean/tuleap/commit/7e221a9d1893c13407b35008762757a76d8e5654Patch, Third Party Advisory
• https://github.com/Enalean/tuleap/commit/cc38bcc59ce0c733ca915d95daec5f3082fb17caPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hvx6-4228-whj3Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=7e221a9d1893c13407b35008762757a76d8e5654Patch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=26816Issue Tracking, Vendor Advisory

Published

Jun 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31027OAuthenticator is an OAuth token library for the JupyerHub l…6.5
• CVE-2022-31028MinIO is a multi-cloud object storage solution. Starting wit…7.5
• CVE-2022-31029AdminLTE is a Pi-hole Dashboard for stats and configuration.…4.8
• CVE-2022-3103off-by-one in io_uring module.7.8
• CVE-2022-31030containerd is an open source container runtime. A bug was fo…5.5
• CVE-2022-31031PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-31033The Mechanize library is used for automating interaction wit…7.5
• CVE-2022-31034Argo CD is a declarative, GitOps continuous delivery tool fo…8.1
• CVE-2022-31035Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2022-31036Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2022-31037OroCommerce is an open-source Business to Business Commerce …5.4
• CVE-2022-31038Gogs is an open source self-hosted Git service. In versions …5.4