CVE-2025-30209

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10.

• CWE-863

• https://github.com/Enalean/tuleap/commit/34af2d5d10b0349967129f53427f495815e5bbccPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hcp5-pmpm-mgwhThird Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=34af2d5d10b0349967129f53427f495815e5bbccBroken Link
• https://tuleap.net/plugins/tracker/?aid=42251Vendor Advisory

Published

Mar 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30203Tuleap is an Open Source Suite to improve management of soft…4.8
• CVE-2025-30204golang-jwt is a Go implementation of JSON Web Tokens. Starti…7.5
• CVE-2025-30205kanidim-provision is a helper utility that uses kanidm's API…7.6
• CVE-2025-30206Dpanel is a Docker visualization panel system which provides…9.8
• CVE-2025-30207Kirby is an open-source content management system. A vulnera…7.5
• CVE-2025-30208Vite, a provider of frontend development tooling, has a vuln…7.5
• CVE-2025-3021Path Traversal vulnerability in e-solutions e-management. Th…8.7
• CVE-2025-30210Bruno is an open source IDE for exploring and testing APIs. …6.1
• CVE-2025-30211Erlang/OTP is a set of libraries for the Erlang programming …7.5
• CVE-2025-30212Frappe is a full-stack web application framework. An SQL Inj…7.5
• CVE-2025-30213Frappe is a full-stack web application framework. Prior to v…8.8
• CVE-2025-30214Frappe is a full-stack web application framework. Prior to v…7.5