CVE-2026-14165
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.
Risk Assessment
The risk involves unauthorized access to sensitive data of other users, potentially leading to confidentiality and integrity breaches within the organization.
Recommendation
It is recommended to immediately upgrade Tuleap Enterprise Edition to version 17.6 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Tuleap Enterprise Edition
See all- CVE-2026-105412High
An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to gain read access to the Tuleap database.
- CVE-2026-105411High
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.
- CVE-2026-105410High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-105409High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-105408High
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.
- CVE-2026-84285High
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
- CVE-2026-19851High
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
Original NVD description (English source)
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS