CVE-2022-31128

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions. Users can create branches via the REST endpoint `POST git/:id/branches` regardless of the permissions set on the repository. This issue has been fixed in version 13.10.99.82 Tuleap Community Edition as well as in version 13.10-3 of Tuleap Enterprise Edition. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-862

• https://github.com/Enalean/tuleap/commit/58ecb1dee1c46075d3e089980301ebfbe0bafd33Patch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-2p49-vgcx-5w79Patch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=58ecb1dee1c46075d3e089980301ebfbe0bafd33Patch, Third Party Advisory
• https://tuleap.net/plugins/tracker/?aid=27538Issue Tracking, Patch, Vendor Advisory
• https://github.com/Enalean/tuleap/commit/58ecb1dee1c46075d3e089980301ebfbe0bafd33Patch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-2p49-vgcx-5w79Patch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=58ecb1dee1c46075d3e089980301ebfbe0bafd33Patch, Third Party Advisory
• https://tuleap.net/plugins/tracker/?aid=27538Issue Tracking, Patch, Vendor Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31122Wire is an encrypted communication and collaboration platfor…8.1
• CVE-2022-31123Grafana is an open source observability and data visualizati…7.8
• CVE-2022-31124openssh_key_parser is an open source Python package providin…6.5
• CVE-2022-31125Roxy-wi is an open source web interface for managing Haproxy…9.8
• CVE-2022-31126Roxy-wi is an open source web interface for managing Haproxy…9.8
• CVE-2022-31127NextAuth.js is a complete open source authentication solutio…6.1
• CVE-2022-31129moment is a JavaScript date library for parsing, validating,…7.5
• CVE-2022-3113An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31130Grafana is an open source observability and data visualizati…7.5
• CVE-2022-31131Nextcloud mail is a Mail app for the Nextcloud home server p…4.3
• CVE-2022-31132Nextcloud Mail is an email application for the nextcloud per…9.8
• CVE-2022-31133HumHub is an Open Source Enterprise Social Network. Affected…4.8