CVE-2025-29766

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.

• CWE-352

• https://github.com/Enalean/tuleap/commit/81f45330fdcc1329cc71eddf4d04b80c340b3b93Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-6p9q-p2q4-3rqxThird Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=81f45330fdcc1329cc71eddf4d04b80c340b3b93Broken Link
• https://tuleap.net/plugins/tracker/?aid=42208Vendor Advisory

Published

Mar 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29746Cross Site Scripting vulnerability in Koillection v.1.6.10 a…6.1
• CVE-2025-2975A vulnerability was found in GFI KerioConnect 10.0.6 and cla…5.4
• CVE-2025-29756SunGrow's back end users system iSolarCloud https://isolarc…8.3
• CVE-2025-29757An incorrect authorisation check in the the 'plant transfer'…9.4
• CVE-2025-2976A vulnerability was found in GFI KerioConnect 10.0.6. It has…5.4
• CVE-2025-29763Rejected reason: “This CVE ID is Rejected and will not be us…
• CVE-2025-29768Vim, a text editor, is vulnerable to potential data loss wit…4.4
• CVE-2025-29769libvips is a demand-driven, horizontally threaded image proc…5.5
• CVE-2025-2977A vulnerability was found in GFI KerioConnect 10.0.6. It has…5.4
• CVE-2025-29770vLLM is a high-throughput and memory-efficient inference and…6.5
• CVE-2025-29771HtmlSanitizer is a client-side HTML Sanitizer. Versions prio…5.3
• CVE-2025-29772OpenEMR is a free and open source electronic health records …6.1