Tuleap Enterprise Edition CVE-2026-105408

Exploitation requires an authenticated Tuleap Enterprise Edition account (PR:L) with the ability to write content into a persisted field, and a separate victim user must subsequently view that content (UI:R) for the stored script to execute - ideally a higher-privileged user to maximize impact. Limiting factors: attacker must already hold valid credentials or a usable low-privilege account, the payload only fires when another user renders the affected view, and only deployments running versions 17.0 through 17.5 are affected. The specific injectable feature/field is not named in the provided description and should be identified from the 3DS advisory.

This is a stored XSS (CWE-79) in Tuleap Enterprise Edition 17.0-17.5, carrying a vendor CVSS 3.1 score of 8.7 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The elevated score is driven primarily by the scope change (S:C) and high confidentiality/integrity impact that stored XSS can achieve by executing in other users' authenticated sessions. However, two signals temper the raw score: the vector requires PR:L (the attacker needs a valid authenticated account to plant the payload) and UI:R (a victim - ideally a higher-privileged user - must view the poisoned content). No EPSS probability, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active or at-scale exploitation; the realistic threat is a motivated authenticated insider or a compromised low-privilege account targeting specific users rather than opportunistic mass exploitation. Net: a genuine high-severity bug worth prioritizing for Tuleap operators, but the authentication and user-interaction prerequisites make it a targeted/post-authentication risk rather than an internet-wide emergency. The C:H/I:H rating is somewhat generous for typical XSS and should be validated against the actual sink and victim privilege level with the vendor advisory.

An attacker with a low-privilege Tuleap account injects a malicious script into a persisted field (e.g., a tracker, document, or project artifact). When an administrator or other user later views that content, the script executes in their authenticated browser session, enabling session/token theft or actions performed as the victim. No public exploit code was identified in the provided data.