---
id: CVE-2026-105411
title: >-
  An Authorization Bypass Through User-Controlled Key vulnerability affecting
  Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with
  tracker administration rights on one tracker to update or delete fields of all
  the …
summary: >-
  An Authorization Bypass Through User-Controlled Key vulnerability affecting
  Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with
  tracker administration rights on one tracker to update or delete fields of all
  the …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-639
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T11:17:10.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105411'
references:
  - url: >-
      https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105411
    label: 3DS.Information-Security@3ds.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.105Z'
---

## Overview

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.