CVE-2023-35938

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-281

• https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9qPatch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91Patch
• https://tuleap.net/plugins/tracker/?aid=32278Issue Tracking, Vendor Advisory
• https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9qPatch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91Patch
• https://tuleap.net/plugins/tracker/?aid=32278Issue Tracking, Vendor Advisory

Published

Jun 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35932jcvi is a Python library to facilitate genome assembly, anno…8.8
• CVE-2023-35933OPenFGA is an open source authorization/permission engine bu…7.5
• CVE-2023-35934yt-dlp is a command-line program to download videos from vid…8.2
• CVE-2023-35935Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-35936Pandoc is a Haskell library for converting from one markup f…5
• CVE-2023-35937Metersphere is an open source continuous testing platform. I…8.8
• CVE-2023-35939GLPI is a free asset and IT management software package. Sta…8.1
• CVE-2023-35940GLPI is a free asset and IT management software package. Sta…7.5
• CVE-2023-35941Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-35942Envoy is an open source edge and service proxy designed for …6.5
• CVE-2023-35943Envoy is an open source edge and service proxy designed for …7.5
• CVE-2023-35944Envoy is an open source edge and service proxy designed for …5.3