GitLab CE/EE CVE-2026-16275

Requires a GitLab CE/EE instance running an affected version (17.4 up to but not including 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2) that hosts public projects containing confidential notes. The vendor states exploitation is possible only 'under certain conditions,' so it is not reproducible against every public project - the specific triggering state is not enumerated in available data and should be verified with GitLab. Limiting factors: only confidential notes on public projects are exposed (private/internal projects are not implicated by the description); impact is confined to confidentiality (reading), with no write or availability effect. No authentication or user interaction is required (PR:N/UI:N), which removes the usual access barrier.

This is a genuine but moderate-risk information-disclosure flaw, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) describes a network-reachable, low-complexity, unauthenticated issue with only LOW confidentiality impact and no integrity or availability impact - consistent with the description of an unauthenticated user reading confidential notes on public projects (CWE-863, incorrect authorization). Publicly available exploit code exists (referenced HackerOne report #3815259), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation at time of analysis. The 'under certain conditions' qualifier in the vendor description signals that exploitation is not universal across all public projects, tempering the otherwise unauthenticated (PR:N) attack profile. Net: POC availability warrants timely patching of internet-facing GitLab instances, but the capped LOW-confidentiality, no-integrity/availability impact makes this a routine-priority patch rather than an emergency. Note the conflict worth flagging: POC availability is a distinct signal from active exploitation - do not treat the existence of exploit code as in-the-wild use.

An unauthenticated attacker browses a public GitLab project and, under the specific conditions that trigger the faulty authorization check, issues requests that return confidential notes intended to be restricted. A working proof-of-concept is publicly documented in the referenced HackerOne report, and because the CVSS vector is network/low-complexity/no-privileges, the request can be sent remotely without any account or user interaction.