What is CVE-2026-24007?

CVE-2026-24007 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.6/10. Published 2026-02-02.

How severe is CVE-2026-24007?

Medium severity. CVSS v3 base score is 4.6 out of 10.

CSRF in Enalean Tuleap

CVE-2026-24007

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.001 (3.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L.

Affected products

Enalean Tuleap — versions < 17.0.99.1768924735

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC, Broken Link)
security-advisories@github.com (x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2026-24007?: CVE-2026-24007 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.6/10. Published 2026-02-02.
How severe is CVE-2026-24007?: Medium severity. CVSS v3 base score is 4.6 out of 10.