What is the CVSS score of CVE-2026-24007?

CVE-2026-24007 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Tuleap are affected by CVE-2026-24007?

Organizations using Tuleap should be aware of moderate risk from CVE-2026-24007, a cross-site request forgery vulnerability rated CVSS 4.6. Users could be tricked into performing unintended actions.. A patch is available.

How to fix or mitigate CVE-2026-24007?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Tuleap CVE-2026-24007

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-02-02 security-advisories@github.com

CSRF Tuleap

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

Patch released

Feb 23, 2026 - 20:29 nvd

Patch available

CVE Published

Feb 02, 2026 - 23:16 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

AnalysisAI

Missing CSRF protection in Tuleap's Overview inconsistent items feature allows authenticated attackers to trick users into performing unwanted actions via crafted requests, potentially leading to unauthorized artifact link creation and data manipulation. The vulnerability affects multiple Tuleap versions and has been patched in Community Edition 17.0.99.1768924735 and Enterprise Edition 17.2-5, 17.1-6, and 17.0-9. This requires user interaction and valid credentials but poses a moderate risk to Tuleap deployments.

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Tuleap. Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.