Home

Description

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2.

PUBLISHED Reserved 2025-06-20 | Published 2025-07-29 | Updated 2025-07-29 | Assigner GitHub_M




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-204: Observable Response Discrepancy

Product status

Tuleap Community Edition < 16.9.99.1750843170
affected

Tuleap Enterprise Edition >= 16.9, < 16.9-2
affected

Tuleap Enterprise Edition < 16.8-4
affected

References

github.com/...tuleap/security/advisories/GHSA-xqf3-xxxf-x3c2

github.com/...ommit/5c72d6d253016d38ed472eb7918f772d074ddb07

tuleap.net/...mit&h=5c72d6d253016d38ed472eb7918f772d074ddb07

tuleap.net/plugins/tracker/?aid=43674

cve.org (CVE-2025-52899)

nvd.nist.gov (CVE-2025-52899)

Download JSON