Tuleap CVE-2025-53902 Artifact Information Disclosure via Email Notifications

Critical Vulnerability Information Vulnerability Overview Artifact ID: 443704 Submitter: Antoine Souteau (antoinesauteau) Submission Date: 2025-07-10 18:02 Last Modified: 2025-07-21 16:11 Vulnerability Details Summary: Artifact disclosure to a mentioned user via email notifications Original Report: When a user is mentioned in a comment on an artifact, they receive an email notification even if they do not have permission to access the artifact. The notification may include the entire content of the artifact, if field permissions allow. Impact: Users may gain access to confidential information within artifacts they are not authorized to view. CVSS v3.1 Score: 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Exploitation Method 1. Create an artifact in a restricted-access tracker. 2. Comment on this artifact and mention a user who does not have access permissions. 3. Check the email inbox associated with the mentioned user’s account. References CVE: 2025-53902 OWASP Broken Access Control Status Status: Closed Closed Date: 2025-07-15 Assigned To: Antoine Souteau (antoinesauteau) Tracking History Public Disclosure: Submitted by Thomas Gerbet CVE Assignment: CVE-2025-53902 assigned to this issue Fix Submission: Merge commit refs/changes/71/34971/3 at ssh://git.tuleap.net:29418/tuleap into HEAD.

Goal Reached Thanks to every supporter — we hit 100%!

Tuleap CVE-2025-53902 Artifact Information Disclosure via Email Notifications