CVE-2026-14165

Full vulnerability record from the local CVENow database.

Description

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-07-13 08:16:20.253000

Last modified

2026-10-24 22:10:00.210000

View original CVE JSON

{
  "id": "CVE-2026-14165",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-13T08:16:20.253",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autorización a través de clave controlada por el usuario que afecta a Tuleap Enterprise Edition desde la 17.0 hasta la 17.5 podría permitir a un atacante acceder a datos de otros usuarios sin autorización."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dassault Systèmes",
          "product": "Tuleap Enterprise Edition",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "17.0-1",
              "lessThanOrEqual": "17.0-31",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "17.5-1",
              "lessThanOrEqual": "17.5-17",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T14:47:14.604186Z",
          "id": "CVE-2026-14165",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-14165",
      "source": "[email protected]"
    }
  ]
}