CVE-2026-14165

HighCVSS 7.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.

Risk Assessment

The risk involves unauthorized access to sensitive data of other users, potentially leading to confidentiality and integrity breaches within the organization.

Recommendation

It is recommended to immediately upgrade Tuleap Enterprise Edition to version 17.6 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Tuleap Enterprise Edition

CVE-2026-19851High
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.

Original NVD description (English source)

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.