CVE-2025-52899 Tuleap vulnerable to user enumeration via the lost password form

What is CVE-2025-52899?

CVE-2025-52899 is a medium-severity vulnerability in Enalean Tuleap, published on 29 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2.

Weakness: CWE-204

Which versions are affected by CVE-2025-52899?

It affects 1 product.

Products include Enalean Tuleap.

How do I fix CVE-2025-52899?

No fix has been published for CVE-2025-52899 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-52899 being exploited?

There is no known exploitation of CVE-2025-52899 in the wild and no public exploit code.

Other vulnerabilities in Enalean Tuleap

• CVE-2018-17298 Business logic in n/a Critical 9.8
• CVE-2018-7538 SQL injection in n/a Critical 9.8
• CVE-2014-7178 Command injection in n/a Critical 9.3
• CVE-2021-43806 SQL injection in Tuleap High 8.8
• CVE-2021-41154 SQL injection in the "SVN core" commits browser High 8.8

All Enalean Tuleap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xqf3-xxxf-x3c2.