The flaw is a missing CSRF protection on the Overview inconsistent items interface, allowing an attacker to trick a user into resolving item inconsistencies while simultaneously creating new artifact links from a release. This alters project data without the user’s intent and is a classic Cross‑Site Request Forgery (CWE‑352).

Enalean Tuleap Community Edition 17.0.99.1768924735 and newer, and Enterprise Editions 17.2‑5, 17.1‑6, or 17.0‑9 and newer are fixed; all earlier releases across community and enterprise distributions remain susceptible.

The CVSS score of 4.6 classifies the vulnerability as moderate, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. It is not listed in CISA’s KEV catalog. Exploitation would require a victim to click a malicious link or form, implying a user‑interaction vector that an attacker typically achieves through phishing or social engineering. The potential impact of unauthorized link creation could disrupt release workflows and data integrity, justifying prompt remediation.