Tuleap Cross-Tracker Permission Vulnerability in Special Fields

A vulnerability exists in Tuleap Community Edition versions prior to 16.10.99.1754050155 and Tuleap Enterprise Edition versions prior to 16.9-8 and 16.10-5. This vulnerability allows attackers to access the content of special fields in accessible artifacts, regardless of the permissions associated with those fields. The issue arises because cross-tracker searches do not properly verify field permissions.

Impact

Exploitation of this vulnerability allows unauthorized access to special fields in artifacts, bypassing established permission controls.

Remediation

Users can upgrade to Tuleap Community Edition 16.10.99.1754050155 or Tuleap Enterprise Edition 16.10-5 or 16.9-8 to address this vulnerability.