CSRF Vulnerability in Tuleap Planning Management API
CVE-2025-64499

4.6MEDIUM

Key Information:

Vendor

Enalean

Status
Tuleap
Vendor
CVE Published:
8 December 2025

What is CVE-2025-64499?

Tuleap, an open-source software development and collaboration suite, is susceptible to Cross-Site Request Forgery (CSRF) attacks through its planning management API. Unsanctioned actors can potentially create, edit, or delete planning plans without proper authorization. This security issue affects specific versions of Tuleap, prompting the need for immediate updates to the fixed versions to safeguard against any unauthorized manipulation.

Affected Version(s)

tuleap Tuleap Community Edition < 17.0.99.1762456922 < Tuleap Community Edition 17.0.99.1762456922

tuleap Tuleap Enterprise Edition < 17.0-2 < Tuleap Enterprise Edition 17.0-2

tuleap Tuleap Enterprise Edition < 16.13-7 < Tuleap Enterprise Edition 16.13-7

References

https://github.com/Enalean/tuleap/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/1734a7bb29640423...
x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=com...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64499 : CSRF Vulnerability in Tuleap Planning Management API