Fine grained permissions are not checked when creating a branch with the REST API
Package
Tuleap Community Edition
(tuleap)
Affected versions
>= 13.9.99.110 && < 13.10.99.82
Patched versions
13.10.99.82
Tuleap Enterprise Edition
(tuleap)
>= 13.10 && < 13.10-3
13.10-3
Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions.
Impact
Users can create branches via the REST endpoint
POST git/:id/branchesregardless of the permissions set on the repository.Patches
The following versions contain the fix:
For more information
If you have any questions or comments about this advisory, reach out to us via the contact information provided on the Tuleap.org security page.
References