An Authorization Bypass Through User‑Controlled Key vulnerability in Tuleap Enterprise Edition allows attackers who possess tracker administration rights on a single tracker to update or delete fields of all trackers across the instance. This flaw is identified as CWE‑639, indicating that the application does not enforce proper authorization checks when a user‑controlled parameter is used to determine permissions, enabling a privilege escalation attack.

The vulnerability affects Dassault Systèmes Tuleap Enterprise Edition versions 17.0 through 17.5. No narrower sub‑versions or modules are specified; all installations of these releases are potentially impacted when tracker administration functionality is enabled.

The CVSS score of 8.1 classifies the issue as High severity, indicating a significant impact on tracker data integrity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is active only for users with tracker administration privileges, which are typically limited. The flaw allows an attacker with such rights to specify a user‑controlled key that bypasses the intended authorization guard, enabling modification or deletion of fields across all trackers in the instance.