{"id":"CVE-2026-105411","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105411","generatedAt":"2026-10-28T01:11:58.365Z","title":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the…","description":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.","published":"2026-10-12T11:17:10.000Z","lastModified":"2026-10-16T17:17:24.000Z","status":"Deferred","sourceIdentifier":"3DS.Information-Security@3ds.com","cvss":{"version":"3.1","score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00234,"percentile":0.14232,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00234,"percentile":0.1327}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T11:17:10.000Z","detail":{"score":"8.1","severity":"HIGH","publishedAt":"2026-10-12T11:17:10.187Z"},"summary":"New CVE, high severity (CVSS 8.1)."}],"references":[{"url":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411","source":"3DS.Information-Security@3ds.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105411","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}