CVE-2026-14165: High-Severity Authorization Bypass Flaw Hits Tuleap Enterprise 17.0

A newly disclosed vulnerability in Tuleap Enterprise Edition could allow attackers to peek at other users’ data, exposing a gap in how the popular DevOps and project management platform verifies who is allowed to see what.

Tracked as CVE-2026-14165 and published on July 13, 2026, the flaw is classified as an Authorization Bypass Through User-Controlled Key issue, rated High severity, and it affects every Tuleap Enterprise Edition release from version 17.0 through 17.5.

The bug falls under CWE-639, a well-documented weakness class in which an application relies on a client-supplied identifier, such as a record ID, project key, or session token, to fetch data without properly verifying that the requesting user actually owns or has permission to view that resource.

High-Severity Authorization Bypass Flaw

In Tuleap’s case, this could allow an authenticated attacker to manipulate a user-controlled key and access records, files, or project information belonging to accounts they were never granted access to.

This is not the first time Tuleap has grappled with this exact weakness. A similar CWE-639 issue, CVE-2025-64497, surfaced late last year in the platform’s file release system, allowing low-privileged users to access project data outside their authorized scope.

The recurrence of the same bug class across releases suggests that access-control logic tied to user-supplied keys remains a persistent blind spot in Tuleap’s architecture.

Tuleap Enterprise Edition is widely deployed by software teams for agile planning, source code management, and issue tracking, often housing proprietary code artifacts, internal documents, and sensitive project metadata.

An authorization bypass in this context does not require exotic exploitation techniques; it simply requires an authenticated but unprivileged user to alter a parameter and retrieve information that should be walled off, making it a low-effort, high-impact attack path for insider threats or compromised low-tier accounts.

The vulnerability spans a broad range of the Enterprise Edition lineage, as detailed below.

Detail	Information
CVE ID	CVE-2026-14165
Vulnerability class	CWE-639, Authorization Bypass Through User-Controlled Key
Affected product	Tuleap Enterprise Edition
Affected versions	17.0 through 17.5
Severity	High
Published	July 13, 2026

Enalean, the company behind Tuleap, has published remediation guidance through its customer portal for Enterprise Edition subscribers, directing administrators to the official documentation folder for patched builds and configuration steps.

Mitigation

Security teams running any Tuleap Enterprise Edition instance between 17.0 and 17.5 should treat this as an urgent patching priority given the High severity rating and the direct exposure of cross-user data.

Upgrade to the patched Enterprise Edition build referenced in Enalean’s official remediation documentation as soon as it is validated in a test environment.
Audit access logs for anomalous requests involving modified keys, IDs, or reference parameters tied to user-specific resources.
Restrict or monitor API and direct-object-reference endpoints that accept user-supplied identifiers until patching is confirmed.
Review recent user activity for signs that lower-privileged accounts accessed data outside their assigned projects.

Given Tuleap’s history with this same vulnerability class, organizations should also consider a broader access-control review rather than treating this as an isolated patch-and-forget incident.