EUVD-2026-50479
GHSA-86r3-q889-hvg2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description states unauthenticated exploitation via public MR, so PR:N overrides the provided PR:L; only confidential issue titles are disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.
AnalysisAI
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Technical ContextAI
GitLab implements a confidentiality model for issues (CWE-1230: Exposure of Sensitive Information Due to Incompatible Policies), where issues can be marked confidential to restrict visibility to project members with appropriate roles. Merge requests, however, can be publicly accessible even on internal or private repositories if project visibility settings permit. The vulnerability arises from a policy incompatibility: when a merge request references or links a confidential issue, the authorization check governing the merge request's public view failed to mask the confidential issue title. The affected CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covers both Community Edition (CE) and Enterprise Edition (EE), spanning a very wide version range from 8.8 through the 19.2 branch. The root cause class (CWE-1230) reflects a systemic failure to enforce the more restrictive of two intersecting access policies - a common class of authorization bypass in platforms with layered visibility controls.
RemediationAI
The primary fix is to upgrade to one of the patched versions released by GitLab: 19.0.5, 19.1.3, or 19.2.1. The patch release advisory is documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. If an immediate upgrade is not possible, a compensating control is to audit and restrict the visibility of merge requests on projects containing confidential issues - specifically, ensuring that projects with confidential issues do not expose merge requests to unauthenticated or non-member users. This can be done via project settings under 'Merge Requests' visibility. The trade-off is reduced collaboration for open-source or externally collaborative projects. Note that this control mitigates exposure but does not fix the underlying authorization flaw, so patching remains mandatory.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today