Skip to main content

Missing Authorization


Severity Medium
Score 5.4/10


Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions and above, prior to, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.

  • LOW
  • LOW
  • NONE
  • LOW
  • LOW
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.


Advisory Timeline

  • Published