Tuleap Enterprise Edition EUVD-2026-65320

Exploitation is conditional on the XML import feature having been used to create at least one active user account in versions 17.0 through 17.5, and that account retaining its default password unchanged after creation. Specifically required: (1) the Tuleap Enterprise Edition instance runs a version between 17.0 and 17.5 inclusive; (2) one or more accounts were provisioned via XML import and have not had their passwords updated; (3) the attacker can enumerate or infer the username of an XML-imported account. The AC:H CVSS metric reflects this account-identification prerequisite. Limiting factors include: accounts created through normal self-registration, LDAP/SSO provisioning, or administrative UI are not subject to this default password assignment; instances where administrators enforced post-import password resets are not vulnerable; and environments where Tuleap is not internet-facing reduce the network-reachable attack surface. No special configuration option or feature toggle is documented in available data as a prerequisite beyond simply using the XML import function.

The CVSS 3.1 base score of 7.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L signals a high-severity flaw that is nonetheless moderated by AC:H - the attacker must enumerate or discover which accounts were provisioned via XML import, adding meaningful friction. No EPSS score was provided in the available intelligence, preventing probabilistic exploitation likelihood comparison. This CVE is not present in CISA KEV, and no public exploit code or POC has been reported, meaning all exploitation risk is currently theoretical rather than empirically observed. The practical risk is tightly scoped: organizations that have never used the XML import feature are not exposed, while those that used it for bulk user migration and left default credentials unchanged face material account-takeover risk. The high C and I impact scores are credible given that account access on a project management platform typically yields access to code repositories, planning artifacts, and potentially CI/CD integrations.

An attacker identifies a Tuleap Enterprise Edition 17.0-17.5 instance through internet scanning or prior reconnaissance, then enumerates usernames via the platform's user directory or API. The attacker identifies accounts created through XML import - potentially by cross-referencing import timestamps, naming conventions, or brute-forcing the default credential - and authenticates successfully, gaining access to the victim's projects, repositories, and artifacts. No public exploit code is required; standard credential-stuffing or login-brute-force tooling is sufficient if the default password is known or guessable.