{"id":"CVE-2026-105411","state":"PUBLISHED","title":"Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5","description":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.","publishedAt":"2026-10-12T10:45:16.950Z","updatedAt":"2026-10-16T16:42:37.282Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"3DS"},"assigner":"3DS","products":["Dassault Systèmes Tuleap Enterprise Edition"],"affected":[{"vendor":"Dassault Systèmes","product":"Tuleap Enterprise Edition","defaultStatus":"unaffected","versions":[{"version":"17.0-1","status":"affected","lessThanOrEqual":"17.0-41","versionType":"custom"},{"version":"17.5-1","status":"affected","lessThanOrEqual":"17.5-32","versionType":"custom"}]}],"references":["https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/105xxx/CVE-2026-105411.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105411","state":"PUBLISHED","datePublished":"2026-10-12T10:45:16.950Z","dateUpdated":"2026-10-16T16:42:37.282Z","assignerShortName":"3DS","assignerOrgId":"f5a594e6-46a7-4e60-8a08-0a786e70e433","dateReserved":"2026-10-05T11:03:40.012Z"},"containers":{"cna":{"title":"Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5","descriptions":[{"lang":"en","value":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance."}],"affected":[{"vendor":"Dassault Systèmes","product":"Tuleap Enterprise Edition","defaultStatus":"unaffected","versions":[{"version":"17.0-1","status":"affected","lessThanOrEqual":"17.0-41","versionType":"custom"},{"version":"17.5-1","status":"affected","lessThanOrEqual":"17.5-32","versionType":"custom"}]}],"references":[{"url":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"CWE-639 Authorization Bypass Through User-Controlled Key","type":"CWE"}]}],"providerMetadata":{"shortName":"3DS","orgId":"f5a594e6-46a7-4e60-8a08-0a786e70e433","dateUpdated":"2026-10-12T10:45:16.950Z"},"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-16T16:42:21.173224Z","id":"CVE-2026-105411","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T16:42:37.282Z"}}]}}}