Tuleap EUVD-2025-201836

Exploitation requires that a user already authenticated to the Tuleap instance - specifically one holding permission to manage tracker triggers - be tricked into interacting with attacker-controlled content (UI:R), because the vulnerable tracker-trigger create/remove endpoints omit anti-CSRF tokens. Limiting factors: the victim must have an active authenticated session and adequate tracker-administration privileges at the moment of the attack, and the attacker must deliver the forged request via social engineering (malicious link/page). Impact is confined to creating or removing tracker triggers (integrity only); there is no data disclosure or denial of service. Affects Tuleap Community Edition before 17.0.99.1763126988 and Enterprise Edition before 17.0-3 and 16.13-8 in default configurations lacking the fix.

This is a genuine but low-priority issue, and the multiple signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3 Medium) describes a classic CSRF (CWE-352): network-reachable and low-complexity, but requiring victim user interaction (UI:R) and yielding only limited integrity impact (I:L) with no confidentiality or availability effect. EPSS is 0.02% (5th percentile), among the lowest possible, and there is no CISA KEV listing and no public proof-of-concept, so no public exploit identified at time of analysis. No SSVC decision record was provided. All signals align on low real-world risk: the attack is unauthenticated from the attacker's perspective but depends entirely on luring an already-authenticated Tuleap user with tracker-admin rights into interacting with attacker-controlled content, and the only consequence is creation/removal of tracker triggers - a workflow-tampering effect, not data theft or system compromise. This is a 'patch in normal cycle' item, not an emergency; the Medium CVSS reflects a real defect in missing CSRF tokens rather than a high real-world threat.

An attacker crafts a malicious web page or email containing a forged request targeting Tuleap's tracker-trigger endpoints and lures an authenticated Tuleap user who has rights to manage tracker triggers into visiting it. Because the affected endpoints lack CSRF protection, the victim's browser silently submits the request using their valid session, creating or removing tracker triggers without their consent. No public exploit code is identified, and success depends on the victim being logged in and having sufficient privileges (UI:R).