GitLab CE/EE CVE-2026-6567

Requires an authenticated GitLab CE/EE account holding at least the Reporter role on a project that has CI artifact reports present; the attacker then accesses report content restricted to higher-privileged roles because an authorization check is missing. Exploitation is limited by the authentication requirement (no anonymous access), the need for the target project to actually contain restricted CI artifact reports, and the unspecified 'under certain conditions' qualifier in the vendor description, which suggests the flaw may not trigger on every project or configuration. Only running affected versions (13.8 up to the fixed 19.2.8 / 19.3.5 / 19.4.2 releases) are exposed.

This is a low-to-moderate priority issue despite deserving timely patching. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity flaw but one gated behind authentication: an attacker must already hold a valid Reporter-role account on the target project (PR:L), and impact is limited to low confidentiality disclosure with no integrity or availability effect. Publicly available exploit code exists (referenced HackerOne report #3603015), which raises the practical likelihood of opportunistic abuse, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the signals point to a targeted information-disclosure weakness rather than a mass-exploited vulnerability. The CVSS vector and the CWE-863 (improper authorization) classification are mutually consistent: this is an authorization bypass by an already-authenticated low-privilege user, not an unauthenticated authentication bypass. The description's 'under certain conditions' qualifier is unexplained in the provided data and should be clarified with GitLab before assuming every Reporter can trigger it. Overall: a real but bounded issue - prioritize behind any unauthenticated or RCE-class findings.

An attacker with a legitimate Reporter-role account on a GitLab project (for example, a low-trust internal user or an external collaborator granted limited access) requests a CI artifact report that should be restricted to higher-privileged roles. Because the authorization check is missing under certain conditions, the server returns the protected report content, disclosing CI/CD data the user was not authorized to see. Public exploit code for this flow exists (HackerOne #3603015), lowering the skill required to reproduce it.