Description

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-12T11:17:10.187Z",
  "pubdate": "2026-10-12T11:17:10.187Z",
  "executiveSummary": "Tuleap Enterprise Edition is susceptible to an authorization bypass vulnerability stemming from improper access control validation. The flaw, categorized as an Authorization Bypass Through User-Controlled Key, exists in the tracker management module. It allows an authenticated user who possesses tracker administration privileges on a single, specific tracker to perform unauthorized administrative operations across the entire Tuleap instance.\nBy manipulating specific parameters within the request, an attacker can escalate their limited administrative context to a global scope, enabling the unauthorized modification or deletion of tracker fields across all trackers on the platform. This vulnerability poses a severe risk to data integrity and configuration management within the affected instance. The flaw affects Tuleap Enterprise Edition versions 17.0 through 17.5. Successful exploitation requires an attacker to already have valid administrative permissions for at least one tracker, representing an escalation of privileges rather than a purely remote entry point for unauthenticated actors. Given the nature of tracker configurations, this vulnerability could lead to widespread disruption of project management workflows and the permanent destruction of metadata or structural field definitions.",
  "technicalDetails": "The vulnerability resides in the access control logic governing tracker administration in Tuleap Enterprise Edition versions 17.0 through 17.5. The root cause is an insecure implementation of authorization checks that relies on user-supplied identifiers (keys) to determine the scope of administrative actions. Specifically, the application fails to adequately validate that the user's administrative rights are bound strictly to the tracker instance identified in the request parameters.\nDuring typical tracker configuration operations, the application processes requests to update or delete tracker fields. The backend logic insufficiently verifies the relationship between the authenticated user's session privileges and the target tracker identifier. An attacker with legitimate administrative rights on Tracker A can intercept a request destined for Tracker A and modify the target identifier to point toward Tracker B, C, or any other tracker within the system. Because the authorization check is keyed to the user's role rather than the specific object instance, the backend validates the user as an 'administrator' and proceeds to execute the requested write or delete operation on the unintended target.\nThe attack flow follows these steps: 1) The attacker authenticates and accesses the administration panel of a tracker they are authorized to manage. 2) Using an interception proxy, the attacker captures the API call or form submission responsible for modifying tracker field definitions. 3) The attacker identifies the key or identifier parameter representing the target tracker or field. 4) The attacker replaces the legitimate identifier with the unique identifier of a different tracker they are not authorized to manage. 5) The server-side logic fails to re-verify authorization against the new identifier and processes the request. 6) Consequently, the attacker effectively alters or deletes fields across any tracker on the instance.\nThis vulnerability highlights a flaw in the application's privilege escalation path, as the administrative boundary is not enforced at the object level. The impact is significant, as it grants unauthorized users full control over the structural integrity of every tracker on the Tuleap instance. This could lead to mass deletion of tracking data, corruption of project workflows, or unauthorized alteration of field types and constraints, ultimately leading to a complete compromise of the platform's data management capabilities."
}