GitLab CE/EE CVE-2026-14351

Exploitation requires two specific conditions to be simultaneously true: (1) the target GitLab project must have at least one merge request that is accessible to unauthenticated users (i.e., the project is public or merge request visibility is not restricted), and (2) that merge request must reference or be linked to a confidential issue within the same project. No authentication is required per the vulnerability description, despite the PR:L designation in the official CVSS vector - this discrepancy should be treated as unresolved until the vendor clarifies. Exploitation is limited to reading confidential issue titles only; issue body content, comments, attachments, and other metadata are not disclosed. The attacker must be able to enumerate or discover relevant merge requests, which is trivial on public projects.

The official CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) indicates a low-privilege network vector with low confidentiality impact, yielding a moderate-low score. However, the vulnerability description explicitly states 'unauthenticated user,' which conflicts with the PR:L (low privileges) designation in the provided CVSS vector - this discrepancy should be verified with the vendor. If truly unauthenticated (PR:N), the actual attack surface is wider than the vector suggests. The impact is limited to confidential issue titles only - not issue bodies, attachments, or other sensitive content - which appropriately constrains severity. No EPSS data was provided, limiting probabilistic exploitation assessment. A publicly available exploit exists (HackerOne report), which elevates the practical risk above what the base score implies. Exploitation is not confirmed in CISA KEV, suggesting exploitation has not been observed at scale. Despite the broad version range (8.8 through pre-fix 19.2), the impact ceiling is low - an attacker gains only issue titles, which may reveal project names, feature names, or security-adjacent context depending on the organization's naming conventions.

An attacker identifies a GitLab project with publicly accessible merge requests and suspects or discovers that confidential issues exist on the project. Without any authentication, the attacker accesses one or more merge requests and observes confidential issue titles leaked in the merge request view - for example, a title such as 'CVE-2026-XXXX: critical auth bypass in payment module' reveals internal security work. A publicly available exploit exists via HackerOne report 3708242, which documents the specific request or condition that triggers the disclosure.