CVE-2025-29929

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.

• CWE-352

• https://github.com/Enalean/tuleap/commit/dce61747f3a169da1f6b585ad5e6e0847fa3c950Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hqqr-p5f6-26vvThird Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dce61747f3a169da1f6b585ad5e6e0847fa3c950Broken Link
• https://tuleap.net/plugins/tracker/?aid=42231Vendor Advisory

Published

Mar 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29923go-redis is the official Redis client library for the Go pro…3.7
• CVE-2025-29924XWiki Platform is a generic wiki platform. Prior to 15.10.14…7.5
• CVE-2025-29925XWiki Platform is a generic wiki platform. Prior to 15.10.14…5.3
• CVE-2025-29926XWiki Platform is a generic wiki platform. Prior to 15.10.15…9.8
• CVE-2025-29927Next.js is a React framework for building full-stack web app…9.1
• CVE-2025-29928authentik is an open-source identity provider. Prior to vers…8
• CVE-2025-2993A vulnerability, which was classified as critical, has been …6.9
• CVE-2025-29930imFAQ is an advanced questions and answers management system…6.9
• CVE-2025-29931A vulnerability has been identified in TeleControl Server Ba…6.3
• CVE-2025-29932In JetBrains GoLand before 2025.1 an XXE during debugging wa…5.3
• CVE-2025-29933Improper input validation within AMD uProf can allow a local…5.5
• CVE-2025-29934A bug within some AMD CPUs could allow a local admin-privile…5.3