Quick answers
- Is CVE-2026-14165 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14165 being exploited in the wild.
- How severe is CVE-2026-14165?
- High severity, with a CVSS score of 7.5, published 13 July 2026.
- Which products and versions are affected?
- Dassault SystèMes Tuleap Enterprise Edition 17.0 through 17.5.
- Is there a fix for CVE-2026-14165?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14165 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-14165?
- Check whether you run Dassault SystèMes Tuleap Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), exists in Tuleap Enterprise Edition versions 17.0 through 17.5. The flaw occurs when the application fails to properly validate that a user has permission to access a specific resource identified by a user-provided key or identifier. A remote, unauthenticated attacker can exploit this by manipulating these identifiers in network requests to access data belonging to other users. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high confidentiality impact with no requirement for authentication or user interaction. Users are advised to consult the vendor's trust center for specific remediation and patching information.
Affected products
- Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5
Timeline
- 2026-07-13: advisory: Initial advisory published by Dassault Systèmes and NVD