CVE-2026-105411

Executive Summary

CVE-2026-105411 is an authorization bypass vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) in Tuleap Enterprise Edition versions 17.0 through 17.5. An attacker who holds tracker administration rights on a single tracker can abuse a user-controlled key to update or delete fields belonging to all trackers on the instance, breaking tenant- and project-level authorization boundaries. With a CVSS base score of 8.1 (High), the flaw carries high integrity and availability impact and is remotely exploitable by a low-privileged authenticated user, though it requires existing tracker administrator access as a precondition.

Technical Analysis

The vulnerability class is CWE-639, Authorization Bypass Through User-Controlled Key. In this class of flaw, an application exposes an object identifier, resource key, or parameter that is supplied by the user and then uses that value to locate or act on a resource without verifying that the requesting user is authorized to access the specific object referenced. The attacker does not need to defeat authentication; instead, they manipulate the identifier to reference resources outside their authorized scope.

Per the NVD description, CVE-2026-105411 affects Tuleap Enterprise Edition from 17.0 through 17.5. The description states that an attacker with tracker administration rights on one tracker could update or delete fields of all the trackers on the instance. This indicates that the enforcement of authorization is scoped incorrectly: the privilege model appears to grant per-tracker administrative capability, but the underlying operation does not re-validate that the acting user has administrative rights over each target tracker. By supplying (or tampering with) a user-controlled key that identifies a tracker or a tracker field, an authenticated low-privileged tracker administrator can cause operations intended for their own tracker to be applied to every tracker on the instance.

The precise identifier name, URL endpoint, and parameter are not disclosed in the available NVD description or CNA title. This report therefore describes the attack at the vulnerability-class level and does not invent function names, endpoints, or parameters. The core technical deficiency is the absence of a server-side ownership/scope check tying the acting user's administrative rights to the specific tracker object referenced by the user-controlled key.

Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, the following is derivable:

• AV:N — reachable over the network, consistent with a web-based collaboration platform.
• AC:L — no special conditions or race windows are required.
• PR:L — the attacker must be authenticated with the low-level tracker administration role.
• UI:N — no victim interaction is needed.
• S:U — impact remains within the same security authority.
• C:N — no confidentiality impact is declared (the flaw affects field modification/deletion, not read access).
• I:H / A:H — high integrity and availability impact, consistent with destructive modification and deletion of fields across all trackers, which can break tracker schemas and dependent workflows.

No public proof-of-concept, Nuclei template, or exploit code has been identified. EPSS has not yet scored this CVE, so no exploitation-likelihood estimate is available and none is fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639) and the NVD description. It uses only concepts that appear in the description and does not assert specific endpoints, parameters, or function names.

1. Reconnaissance / target identification. The attacker requires a valid account on the Tuleap Enterprise Edition instance (17.0 through 17.5) and tracker administration rights on at least one tracker. The attacker identifies the tracker administration functionality exposed to their role and observes the request that carries a user-controlled key identifying the tracker or tracker field being acted upon.

2. Triggering the flaw class. The attacker modifies the user-controlled identifier in the request so that it references a tracker (or tracker field) belonging to a different project or a tracker over which they hold no administrative rights. Because the server does not verify that the acting user is authorized for the referenced object, the request is processed against the unintended target.

3. Execution method (class level). The unauthorized operation is an update or delete of tracker fields. The attacker repeats or automates the request across the range of identifiers, relying on the missing scope check rather than on any memory-safety or injection primitive. Because AV/AC are Network/Low and UI is None, the operation can be performed directly and without victim involvement.

4. Post-exploitation impact. Successful exploitation allows modification or deletion of fields of all trackers on the instance. This maps to the declared I:H (integrity) and A:H (availability) impacts: field deletion can corrupt tracker configurations, break dependent reports, workflows, and integrations, and potentially render affected trackers unusable. No confidentiality impact is declared (C:N), so data exfiltration is not part of the stated impact.

The absence of an in-the-wild exploitation flag (CISA KEV: NO), exploit code, and PoC means there is currently no observed weaponization; the scenario above is a class-level reconstruction of how the described authorization bypass would be exercised.

Impact Assessment

Business impact centers on data and configuration integrity rather than confidentiality. An authenticated attacker with limited, project-scoped tracker administration privileges can escalate the blast radius of their authority to the entire Tuleap instance: the description states they can update or delete fields of all the trackers on the instance. For affected organizations, this enables cross-project tampering and destructive changes that violate project boundaries and the principle of least privilege. Organizations subject to change-control, audit, or compliance requirements may face evidence-integrity concerns if tracker fields record review or approval data.

Blast radius: the entire Tuleap instance's tracker subsystem is in scope for an attacker who holds a single tracker administration role. CVSS subscores confirm this: high integrity impact (I:H) and high availability impact (A:H), with no confidentiality impact (C:N). The scope is unchanged (S:U), and the attack requires low privileges (PR:L) and no user interaction (UI:N). The overall base score is 8.1 (High).

Affected systems: Tuleap Enterprise Edition versions 17.0 through 17.5. Only deployers of the Enterprise Edition within that range are confirmed affected by the advisory description. No affected package data (OSV) or vendor patch version is available, so no fixed version can be named.

Detection Guidance

Detection should focus on tracker-administration actions that reference tracker or field objects outside the actor's authorized scope. Because no PoC or endpoint details are published, the rules below detect the behavioral pattern (privileged tracker field modification/deletion) rather than a specific exploit signature. Tune to your Tuleap deployment's actual URLs and log format.

Sigma Rule

title: Tuleap Tracker Field Modification or Deletion by Unauthorized Actor (CVE-2026-105411)
id: 7c1f9a24-0b6e-4a2e-8f3d-tuleap639
status: experimental
description: Detects tracker field update or delete operations in Tuleap Enterprise Edition that may indicate cross-tracker authorization bypass (CWE-639) by a user with limited tracker administration rights.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105411
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: web
  product: tuleap
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - DELETE
  selection_uri:
    cs-uri-stem|contains:
      - '/tracker'
      - '/plugins/tracker'
  selection_action:
    cs-uri-query|contains:
      - 'field'
      - 'delete'
      - 'update'
  condition: selection_method and selection_uri and selection_action
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
level: high
falsepositives:
  - Legitimate tracker administrators managing fields on trackers they own

YARA Rule

rule CVE_2026_105411_Tuleap_Tracker_Authz_Bypass
{
    meta:
        description = "Detects HTTP request artifacts referencing Tuleap tracker field update/delete actions potentially abused via CWE-639 authorization bypass (CVE-2026-105411)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105411"
        date = "2026-01-01"
        severity = "high"

    strings:
        $tuleap = "Tuleap" ascii nocase
        $tracker = "/plugins/tracker" ascii nocase
        $field = "field" ascii nocase
        $del = "delete" ascii nocase
        $upd = "update" ascii nocase

    condition:
        $tracker and $field and ($del or $upd)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105411 Tuleap Tracker Field Modification/Deletion Attempt (CWE-639 Authorization Bypass)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/tracker"; http.uri; content:"field"; http.uri; pcre:"/(delete|update)/i"; reference:cve,2026-105411; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105411; classtype:attempted-admin; sid:2026105411; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method in ("POST", "PUT", "DELETE")
     and url.path contains "/tracker"]
  [http where http.request.method in ("POST", "PUT", "DELETE")
     and url.path contains "/tracker"
     and (url.query contains "delete" or url.query contains "update")
     and url.query contains "field"]

Splunk SPL Query

index=web sourcetype=tuleap OR sourcetype=access_combined
| eval uri=coalesce(uri_path, cs_uri_stem), query=coalesce(uri_query, cs_uri_query)
| where (match(uri, "(?i)/tracker") OR match(uri, "(?i)/plugins/tracker"))
    AND (match(query, "(?i)field"))
    AND (match(query, "(?i)delete") OR match(query, "(?i)update"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(query) as queries by src_ip user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="tuleap,web,cve-2026-105411,">
  <rule id="105411" level="12">
    <if_sid>31100</if_sid>
    <match>/tracker|/plugins/tracker</match>
    <regex>field</regex>
    <regex>(delete|update)</regex>
    <description>CVE-2026-105411: Potential Tuleap tracker field update/delete via authorization bypass (CWE-639)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_105411,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or fixed version is available from any tracked source. The following guidance is defensive-in-depth; it does not remediate the root cause.

1. Immediate mitigations:

• Treat tracker administration rights as high-value privilege. Audit which accounts hold tracker administration rights on every tracker and remove the role from any account that does not strictly require it, since the flaw lets a single tracker admin affect all trackers.
• Where possible, segment Tuleap instances so that projects with mutually untrusted administrators are not hosted on the same instance, limiting the blast radius of the cross-tracker bypass.
• Increase monitoring and alerting on tracker field modification and deletion activity, especially operations initiated by users whose administrative scope is limited, using the detection rules above.
• Maintain current, offline backups of tracker schemas and configurations to enable recovery from destructive field deletion (availability impact A:H).

2. Patch/upgrade steps:

• No fixed version is available. Monitor the vendor's security advisories for Tuleap Enterprise Edition for a release addressing CVE-2026-105411, and apply it as soon as it is published.
• Until a patch exists, do not rely on the per-tracker administrative boundary for isolation between projects.

3. Long-term hardening:

• Enforce object-level authorization on the server for every identifier supplied by the client (CWE-639 remediation): verify the acting user's rights against the specific target object on each request, not just against the role.
• Apply centralized authorization middleware and consistent scope checks across all tracker mutation endpoints.
• Adopt least privilege for tracker administration and periodically recertify administrative role assignments.
• Log and alert on administrative mutations with the actor, target object, and source IP retained for audit.

References

• NVD — CVE-2026-105411: https://nvd.nist.gov/vuln/detail/CVE-2026-105411
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• Tuleap project and security advisories — https://www.tuleap.org/ (monitor for an advisory addressing CVE-2026-105411)
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry for CVE-2026-105411 as of this report)
• FIRST EPSS — https://www.first.org/epss (CVE-2026-105411 not yet scored)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-105411 at the time of writing. No public PoC, exploit code, or Nuclei template exists.