CVE-2026-105411 Dassault Systèmes CVE debrief

Who should care

Defenders and administrators of Tuleap Enterprise Edition instances should be aware of this vulnerability, especially those with tracker administration rights or responsibility for security configurations and updates.

Why it matters

CVE-2026-105411 is a high-severity vulnerability in Tuleap Enterprise Edition that allows unauthorized modifications to tracker fields, potentially leading to data integrity issues and exposure. Defenders should prioritize verifying exposure, assessing impact, and applying patches or updates.

• Potential unauthorized updates or deletions of fields across trackers
• Exposure of sensitive information through tracker field updates or deletions
• Compromised data integrity due to unauthorized modifications
• Need for verification of instance exposure and potential impact

Technical summary

The vulnerability affects Tuleap Enterprise Edition versions 17.0 through 17.5, allowing an attacker with tracker administration rights to update or delete fields across all trackers on the instance. This issue is caused by an Authorization Bypass Through User-Controlled Key vulnerability. The vulnerability allows unauthorized modifications to tracker fields, potentially leading to data integrity issues and exposure. Defenders should prioritize verifying exposure and assessing potential impact, focusing on Tuleap Enterprise Edition instances with tracker administration rights. The issue requires immediate attention to prevent potential unauthorized updates or deletions of fields across trackers.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on Tuleap Enterprise Edition instances with tracker administration rights.

Recommended defensive actions

• Verify Tuleap Enterprise Edition instances for exposure, specifically checking tracker administration rights and affected versions (17.0-17.5).
• Assess potential impact on instances with tracker administration rights, focusing on update or delete operations across trackers.
• Review and update security configurations for Tuleap Enterprise Edition to restrict tracker administration rights and monitor for suspicious activity.
• Apply vendor-provided patches or updates as available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. The source item from cve_program_cvelist_v5 and a supplemental source reference from Dassault Systèmes offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.