What is the CVSS score of CVE-2026-14165?

CVE-2026-14165 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Tuleap Enterprise Edition are affected by CVE-2026-14165?

Tuleap Enterprise Edition versions 17.0-17.5 contain an unauthenticated authorization bypass (IDOR) enabling attackers to read other users' confidential data; no public exploit identified at time of…

How to fix or mitigate CVE-2026-14165?

Within 24 hours, audit all Tuleap Enterprise Edition deployments to identify instances running versions 17.0-17.5, enable comprehensive access logging at the application and database layer, and create full encrypted backups. Within 7 days, implement network-level access controls restricting Tuleap connectivity to authorized user networks, deploy Web Application Firewall rules to block object identifier enumeration attempts, and review historical access logs for signs of unauthorized data retrieval. Within 30 days, establish continuous monitoring of Dassault Systèmes security advisories for patch availability, evaluate upgrade feasibility to version 17.6 or later, and enforce mandatory multi-factor authentication across all Tuleap users.

Tuleap Enterprise Edition CVE-2026-14165

EUVD-2026-43300 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 3DS

GHSA-8q3h-3r8x-274j

Authentication Bypass Tuleap Enterprise Edition Dassault Syst Mes

7.5

CVSS 3.1 · Vendor: 3DS

Severity by source

Vendor (3DS) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable IDOR with low complexity, but reaching other users' data realistically needs an authenticated session (PR:L); read-only exposure yields C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (3DS).

CVSS VectorVendor: 3DS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 08:22 vuln.today

CVE Published

Jul 13, 2026 - 07:13 cve.org

HIGH 7.5

DescriptionCVE.org

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.

AnalysisAI

Insecure direct object reference (IDOR) in Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5 lets attackers read other users' data by manipulating a user-controlled key/identifier, breaking horizontal authorization boundaries. The CVSS 3.1 vector (AV:N/PR:N) scores it as remotely reachable with high confidentiality impact but no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Tuleap is an open-source Application Lifecycle Management (ALM) suite (issue tracking, source control, agile planning, document management); the Enterprise Edition is the commercially supported distribution maintained by Enalean and, per this advisory, associated with Dassault Systèmes (3DS). The root cause is CWE-639, Authorization Bypass Through User-Controlled Key - a form of insecure direct object reference where the application uses a client-supplied identifier (such as a record, artifact, user, or resource ID) to fetch data without verifying that the requesting user is authorized to access that specific object. Because the access-control check is missing or incomplete on the object key, changing the identifier in a request returns another user's data. The single CPE, cpe:2.3:a:dassault_systèmes:tuleap_enterprise_edition:*, confirms only the Enterprise Edition product line is enumerated.

RemediationAI

Patch available per vendor advisory: upgrade Tuleap Enterprise Edition to a fixed release above 17.5 as directed in the 3DS advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-14165 (an exact fixed version was not included in the provided data, so confirm the target release with the advisory before deploying). If immediate upgrade is not possible, compensating controls include restricting network reachability of the Tuleap instance to trusted users via VPN or IP allowlisting to shrink the attacker pool, enabling and monitoring access logs for anomalous object-ID enumeration or high-volume sequential ID access on data-retrieval endpoints, and tightening project/user membership so sensitive data lives only in projects with minimal cross-user exposure - noting these controls reduce but do not eliminate the horizontal-access flaw and may impede legitimate collaboration.