CVE-2025-27401

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

• CWE-440

• https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffdPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9Patch, Third Party Advisory
• https://tuleap.net/plugins/tracker/?aid=41850Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Mar 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27396A vulnerability has been identified in SCALANCE LPE9403 (6GK…8.8
• CVE-2025-27397A vulnerability has been identified in SCALANCE LPE9403 (6GK…5.1
• CVE-2025-27398A vulnerability has been identified in SCALANCE LPE9403 (6GK…2.7
• CVE-2025-27399Mastodon is a self-hosted, federated microblogging platform.…5.3
• CVE-2025-2740A vulnerability classified as critical has been found in PHP…7.3
• CVE-2025-27400Magento Long Term Support (LTS) is an unofficial, community-…2.9
• CVE-2025-27402Tuleap is an Open Source Suite to improve management of soft…4.6
• CVE-2025-27403Ratify is a verification engine as a binary executable and o…7.2
• CVE-2025-27404Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27405Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27406Icinga Reporting is the central component for reporting rela…7.6
• CVE-2025-27407graphql-ruby is a Ruby implementation of GraphQL. Starting i…9