Dassault SystèmesCVE-2026-14165
Dassault Systèmes Tuleap Enterprise Edition: insecure direct object reference
High7.5CVE-2026-14165 · Published Jul 13, 2026
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Tuleap Enterprise Edition Product | >= 17.0-1, <= 17.0-31 | No fix yet |
| >= 17.5-1, <= 17.5-17 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-639
More Dassault Systèmes advisories
All Dassault Systèmes| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 27 | Dassault Systèmes 3DSwymer: improper authorization | Critical9.3 | No fix yet |
| Aug 25 | Dassault Systèmes Tuleap Enterprise: attacker could gain access to user... | High7.7 | No fix yet |
| Aug 11 | Dassault Systèmes SIMULIA Execution Engine: unsafe deserialization | Critical10.0 | No fix yet |
| Jul 28 | Dassault Systèmes Station Launcher App: unsafe deserialization | Critical10.0 | No fix yet |
| Jul 8 | Dassault Systèmes DELMIA Apriso: improper authentication | Critical9.8 | No fix yet |
| Jul 1 | Dassault Systèmes BIOVIA Workbook: race condition | High8.1 | No fix yet |