Tuleap Enterprise Edition EUVD-2026-43300

Exploitation targets a Tuleap Enterprise Edition (17.0-17.5) endpoint that fetches data using a client-supplied object key (an artifact, record, user, or resource identifier) without verifying the requester's ownership of that object; the attacker must be able to reach the affected endpoint over the network and supply or enumerate valid identifiers belonging to other users. The CVSS vector states PR:N/UI:N (no privileges, no user interaction), but the CWE-639 class and the phrase 'access data of other users' indicate a valid authenticated session is realistically required to reach the vulnerable functionality - this authentication requirement is the primary limiting factor and should be confirmed with the vendor, as it is not settled by the available data. Impact is limited to reading data (C:H, I:N, A:N); the flaw grants no write or denial-of-service capability.

Severity is driven entirely by confidentiality: CVSS 3.1 base 7.5 comes from C:H with I:N/A:N, meaning read-only data exposure and no ability to modify or disrupt. The vector claims network attack, low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), which would make it trivially exploitable; however, this conflicts with the CWE-639 pattern and the description ('access data of other users'), which strongly implies an authenticated session is needed to reach the affected object-fetch endpoint and enumerate other users' keys - verify the true privilege requirement with the vendor, as PR:N may overstate exposure. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active exploitation or automation. Net assessment: a credible, real confidentiality risk for Tuleap Enterprise operators worth prioritized patching, but likely lower real-world urgency than the raw 7.5 suggests given probable authentication requirements and absence of any exploitation signal.

An attacker with (likely) a low-privilege Tuleap account issues API or web requests to a data-retrieval endpoint, substituting the object identifier tied to their own account with identifiers belonging to other users or projects. Because the server trusts the user-supplied key without an ownership check, it returns data the attacker should not see, and iterating through IDs enables bulk harvesting of other users' information. No public POC was identified, and low attack complexity means exploitation requires only crafted requests once a valid endpoint and ID scheme are known.