CVE-2026-24007

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

• CWE-352

• https://github.com/Enalean/tuleap/commit/5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-7g48-rwqj-ffxwPatch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5ec5e81e409892fe0e41f11d5d36ee6c85a6fbb5Broken Link
• https://tuleap.net/plugins/tracker/?aid=46389Issue Tracking

Published

Feb 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24001jsdiff is a JavaScript text differencing implementation. Pri…7.5
• CVE-2026-24002Grist is spreadsheet software using Python as its formula la…9.6
• CVE-2026-24003EVerest is an EV charging software stack. In versions up to …5.3
• CVE-2026-24004Fleet is open source device management software. In versions…5.3
• CVE-2026-24005Kruise provides automated management of large-scale applicat…7.6
• CVE-2026-24006Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-24009Docling Core (or docling-core) is a library that defines cor…9.8
• CVE-2026-2401CWE-532 Insertion of Sensitive Information into Log File vul…5
• CVE-2026-24010Horilla is a free and open source Human Resource Management …8
• CVE-2026-24012Uncontrolled Resource Consumption vulnerability in Apache Io…7.5
• CVE-2026-24013Authentication Bypass by Spoofing vulnerability in Apache Io…9.1
• CVE-2026-24014Apache IoTDB DataNode’s internal RPC interface for creating …9.8