CVE-2025-64499

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

• CWE-352

• https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7xVendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526Broken Link, Patch
• https://tuleap.net/plugins/tracker/?aid=45592Issue Tracking, Vendor Advisory

Published

Dec 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64493SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2025-64494Soft Serve is a self-hostable Git server for the command lin…4.6
• CVE-2025-64495Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2025-64496Open WebUI is a self-hosted artificial intelligence platform…8
• CVE-2025-64497Tuleap is an Open Source Suite for management of software de…6.5
• CVE-2025-64498Tuleap is an Open Source Suite for management of software de…4.3
• CVE-2025-6450A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64500Symfony is a PHP framework for web and console applications …7.3
• CVE-2025-64501ProsemirrorToHtml is a JSON converter which takes ProseMirro…7.6
• CVE-2025-64502Parse Server is an open source backend that can be deployed …6.9
• CVE-2025-64503cups-filters contains backends, filters, and other software …3.3
• CVE-2025-64504Langfuse is an open source large language model engineering …5