EUVD-2026-65320
GHSA-mcjj-mw6v-j777
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Aligns with provided vector: network-accessible platform, AC:H for account-identification prerequisite, PR:N since default credential requires no existing access, and C:H/I:H for full account takeover impact.
Primary rating from Vendor (3DS).
CVSS VectorVendor: 3DS
Lifecycle Timeline
2DescriptionCVE.org
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
AnalysisAI
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is conditional on the XML import feature having been used to create at least one active user account in versions 17.0 through 17.5, and that account retaining its default password unchanged after creation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L signals a high-severity flaw that is nonetheless moderated by AC:H - the attacker must enumerate or discover which accounts were provisioned via XML import, adding meaningful friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Tuleap Enterprise Edition to a version beyond 17.5 per the vendor advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-19851; the exact patched release version is not independently confirmed from the provided data and must be verified directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Tuleap instances running versions 17.0-17.5 and determine if XML import has been used; immediately reset passwords for any accounts created via XML import and enforce strong password requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tuleap Enterprise Edition
View allSame weakness CWE-1393 – Use of Default Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today