Tuleap Enterprise CVE-2026-105412

Exploitation requires an authenticated session on Tuleap Enterprise Edition 17.5 with at least low-level privileges (PR:L) - it is NOT exploitable by fully anonymous/unauthenticated attackers per the CVSS vector. No user interaction or special non-default feature is named in the advisory; the limiting factor is the need for valid, even minimally-privileged, account access to the Tuleap instance, which reduces exposure for deployments that restrict account provisioning or are not internet-facing. The exact vulnerable parameter/feature is not specified in the available data.

This is a credible but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires authenticated low-privilege access (PR:L), which materially narrows the exploit population to users who already hold a valid Tuleap account. Impact is confidentiality-focused (C:H, I:N, A:L), consistent with a read-only SQL injection that can disclose database contents but does not grant write/integrity impact; the A:L likely reflects potential database load/availability degradation from injected queries. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The only source is a single vendor advisory (3ds.com), so exploitation probability signals (EPSS/KEV/POC) are entirely absent rather than low; this means risk is inferred almost solely from the CVSS vector and must be treated as provisional. No conflicting signals were detected between the vector and the description (both point to authenticated, network-based, read-only access).

An authenticated Tuleap user with only low-level privileges submits crafted input to a vulnerable parameter, injecting SQL that the backend executes against the Tuleap database. This lets the attacker read data belonging to other users or projects - potentially credentials hashes, tokens, tracker contents, or configuration - beyond their authorized scope. No public exploit code is referenced, so an attacker would need to develop the injection payload themselves.