CVE-2024-47766

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.

• CWE-280
• CWE-755

• https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hxExploit, Patch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674Issue Tracking, Patch
• https://tuleap.net/plugins/tracker/?aid=39736Exploit, Third Party Advisory

Published

Oct 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47760GLPI is a free asset and IT management software package. Sta…8.8
• CVE-2024-47761GLPI is a free asset and IT management software package. Sta…7.2
• CVE-2024-47762Backstage is an open framework for building developer portal…5.8
• CVE-2024-47763Wasmtime is an open source runtime for WebAssembly. Wasmtime…5.5
• CVE-2024-47764cookie is a basic HTTP cookie parser and serializer for HTTP…6.9
• CVE-2024-47765Minecraft MOTD Parser is a PHP library to parse minecraft se…6.1
• CVE-2024-47767Tuleap is a tool for end to end traceability of application …4.3
• CVE-2024-47768Lif Authentication Server is a server used by Lif to do vari…8.1
• CVE-2024-47769IDURAR is open source ERP CRM accounting invoicing software.…7.5
• CVE-2024-4777Memory safety bugs present in Firefox 125, Firefox ESR 115.1…8.8
• CVE-2024-47770Wazuh is a free and open source platform used for threat pre…8
• CVE-2024-47771Element Desktop is a Matrix client for desktop platforms. El…7