Get real-time updates on Telegram
CVE-2025-54877: tuleap before 16.9-8 (exclusive), before 16.10.99.1754050155 (exclusive), from 16.10 (inclusive), before 16.10-5…
CVE-2025-54877. CVSS 3.1 base score 5.3 (MEDIUM, Vendor/CNA). EPSS 0.00295 (percentile 0.20691), scored 17-Oct-2026.
Affected technology
tuleap · before 16.9-8 (exclusive)
enalean
tuleap · before 16.10.99.1754050155 (exclusive)
enalean
tuleap · from 16.10 (inclusive), before 16.10-5 (exclusive)
enalean
tuleap · Tuleap Community Edition < 16.10.99.1754050155, Tuleap Enterprise Edition < 16.10-5, Tuleap Enterprise Edition < 16.9-8
Enalean
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
An attacker can access to the content of the special and always there fields of accessible artifacts even if the permissions associated with the underlying fields do not allow it. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-863
- CCR priority
- 21.3 /100 (P4)
- CVSS 3.1
- 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · Vendor/CNA
- EPSS
- 0.00295 · percentile 0.20691 · 2026-10-17
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-54877.html