{"api_version":"1","generated_at":"2026-10-12T13:19:22+00:00","cve":"CVE-2026-105411","urls":{"html":"https://cve.report/CVE-2026-105411","api":"https://cve.report/api/cve/CVE-2026-105411.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-105411","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105411"},"summary":{"title":"Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5","description":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.","state":"PUBLISHED","assigner":"3DS","published_at":"2026-10-12 11:17:10","updated_at":"2026-10-12 11:17:10"},"problem_types":["CWE-639","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key"],"metrics":[{"version":"3.1","source":"3DS.Information-Security@3ds.com","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411","name":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411","refsource":"3DS.Information-Security@3ds.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105411","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105411","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Dassault Systèmes","product":"Tuleap Enterprise Edition","version":"affected 17.0-1 17.0-41 custom","platforms":[]},{"source":"CNA","vendor":"Dassault Systèmes","product":"Tuleap Enterprise Edition","version":"affected 17.5-1 17.5-32 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Tuleap Enterprise Edition","vendor":"Dassault Systèmes","versions":[{"lessThanOrEqual":"17.0-41","status":"affected","version":"17.0-1","versionType":"custom"},{"lessThanOrEqual":"17.5-32","status":"affected","version":"17.5-1","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance."}],"value":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-12T10:45:16.950Z","orgId":"f5a594e6-46a7-4e60-8a08-0a786e70e433","shortName":"3DS"},"references":[{"url":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411"}],"source":{"discovery":"EXTERNAL"},"title":"Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"f5a594e6-46a7-4e60-8a08-0a786e70e433","assignerShortName":"3DS","cveId":"CVE-2026-105411","datePublished":"2026-10-12T10:45:16.950Z","dateReserved":"2026-10-05T11:03:40.012Z","dateUpdated":"2026-10-12T10:45:16.950Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-12 11:17:10","lastModifiedDate":"2026-10-12 11:17:10","problem_types":["CWE-639","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key"],"metrics":{"cvssMetricV31":[{"source":"3DS.Information-Security@3ds.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105411","Ordinal":"1","Title":"Authorization Bypass Through User-Controlled Key vulnerability a","CVE":"CVE-2026-105411","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105411","Ordinal":"1","NoteData":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.","Type":"Description","Title":"Authorization Bypass Through User-Controlled Key vulnerability a"}]}}}