Tuleap Enterprise Edition EUVD-2026-97331

Exploitation requires an authenticated account that already holds tracker administration rights on at least one tracker within the Tuleap instance (per CVSS PR:L); it is not exploitable by anonymous or unauthenticated users. The attacker then supplies a user-controlled key (tracker or field identifier) referencing fields belonging to trackers they do not administer, and the missing cross-tracker authorization check allows update or deletion of those fields. Limiting factors: a valid low-privilege tracker-admin role is mandatory, the instance must be running affected versions 17.0 through 17.5, and real impact scales with how many other trackers/projects share the same instance (highest in large multi-team deployments). No special non-default configuration is indicated by the description.

This is a credible, above-average-priority issue for organizations running the affected Tuleap Enterprise Edition versions, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high integrity and availability impact but no confidentiality impact - consistent with CWE-639 (Authorization Bypass Through User-Controlled Key), where an attacker manipulates an object reference (a tracker/field identifier) to act on resources outside their authorized scope. The key limiting factor is PR:L: the attacker must already be a legitimate tracker administrator on at least one tracker, so this is a privilege-escalation/lateral-movement flaw exploitable by insiders or compromised low-trust accounts rather than by anonymous internet attackers. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation - the risk rating rests on the CVSS signal alone. The 'Authentication Bypass' tag conflicts with the actual CWE-639 classification (this is an authorization, not authentication, bypass); treat that tag as mislabeled and do not infer unauthenticated access from it.

A user who has been granted tracker administration rights on a single project tracker in a shared Tuleap instance manipulates the user-controlled tracker/field identifier in an administrative API or web request to target fields belonging to trackers in other projects they do not administer. Using this, they modify or delete field definitions across the entire instance, corrupting or destroying other teams' tracker data. No public exploit code is identified in the provided data, and exploitation requires an existing authenticated tracker-admin account.