Tuleap Backlog Tracker Permission Vulnerability

A vulnerability exists in Tuleap's backlog item representations, specifically in versions prior to 16.11.99.1757427600 for the Community Edition and prior to 16.11-6 and 16.10-8 for the Enterprise Edition. The issue arises because the representations do not properly verify permissions for child trackers. As a result, users may be able to see tracker names that they should not have access to.

Impact

This vulnerability could lead to unauthorized visibility of tracker names, allowing users to see trackers they should not have access to.

Reproduction

To reproduce this vulnerability, a user must be assigned to a tracker that has child trackers not accessible to them. When viewing a backlog item that contains these child trackers, the user will see tracker names they should not have access to.

Remediation

Users can upgrade to Tuleap Community Edition 16.11.99.1757427600 or Tuleap Enterprise Edition 16.11-6 or 16.10-8 to address this vulnerability.