EUVD-2026-42405
GHSA-mj6c-rwfc-g9jh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L confirmed as exploitation requires an authenticated low-privilege account; C:L reflects metadata-only disclosure with no code, secret, or integrity impact.
Primary rating from Vendor (gitlab).
CVSS VectorVendor: gitlab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks.
AnalysisAI
Work item metadata in GitLab EE is exposed to authenticated users holding only minimal project permissions due to missing authorization checks on affected API or web endpoints, enabling unauthorized reads of private project data. Affected deployments span GitLab EE 18.9 through pre-18.11.7, 19.0 through pre-19.0.4, and 19.1 through pre-19.1.2, with patched releases now available from the vendor. No public exploit has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and the CVSS 4.3 Medium score reflects narrow impact - confidentiality-only, metadata-scoped, with no integrity or availability consequence.
Technical ContextAI
GitLab EE implements work items (a unified model covering issues, tasks, objectives, and key results) with project-scoped access controls enforced at the application layer. The root cause is CWE-862 (Missing Authorization): under certain unspecified conditions, the server omits the required authorization gate when responding to work item metadata requests, allowing callers whose session token reflects only minimal membership privileges to retrieve metadata from private projects they are not authorized to access. The CVSS vector (AV:N/AC:L/PR:L) confirms the flaw is reachable over the network without elevated complexity, consistent with a standard GitLab API or GraphQL endpoint responding without validating project-level visibility policy. No CPE string was provided in the input, but the EUVD entry EUVD-2026-42405 and NVD references bound the affected surface to GitLab EE specifically.
RemediationAI
Upgrade GitLab EE to 18.11.7, 19.0.4, or 19.1.2 - whichever corresponds to your active release track - per the vendor patch release at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/. GitLab.com SaaS instances are patched automatically by GitLab. For self-managed administrators unable to patch immediately, restricting instance membership to invitation-only (disabling open registration and external user sign-up) reduces the pool of accounts that could exploit the flaw, since exploitation requires an authenticated session; however, this does not eliminate the vulnerability and carries the operational trade-off of blocking legitimate self-registration flows. Additionally, auditing and minimizing which private projects contain sensitive work item metadata (e.g., moving security vulnerability tracking to separate isolated instances) can reduce the blast radius of unauthorized reads pending patch deployment. No patch version beyond the confirmed 18.11.7/19.0.4/19.1.2 releases has been independently verified from the available data.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today