Tuleap REST API Parent Tracker Permission Vulnerability

A vulnerability exists in Tuleap's REST API, where read permissions are not properly enforced on parent trackers. This issue allows users to access names and colors of parent trackers that they should not be able to see. The vulnerability is present in Tuleap Community Edition versions prior to 16.5.99.1742392651, as well as in Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8.

Impact

Exploitation of this vulnerability could lead to unauthorized visibility of tracker names and details that are meant to be restricted.

Reproduction

To reproduce this vulnerability, access a child tracker that has a parent tracker. Then, send a GET request to the child tracker’s API endpoint. The response will include the parent tracker’s name and color, even if the user does not have permission to view that tracker.

Remediation

Users can upgrade to Tuleap Community Edition 16.5.99.1742392651 or Tuleap Enterprise Edition 16.5-5 or 16.4-8 to address this vulnerability.