GitLab CE/EE EUVD-2026-30226

The GitLab Jira integration must be configured and active on the target GitLab project or instance - this vulnerability does not affect GitLab instances without any Jira integration enabled. The CVE description specifies 'authenticated user' as the actor, meaning a valid GitLab account is required at minimum; however, the CVSS vector lists PR:N (no privileges required), which is in direct conflict - exploitation conditions regarding authentication level should be verified with GitLab before assuming unauthenticated access is possible. The attack is limited to confidentiality of Jira issue data; there is no integrity or availability impact, and no privilege escalation within GitLab itself. Exploitation is constrained to the data visible through the Jira integration, not arbitrary Jira API access. Instances where Jira is configured at the group or instance level may expose a broader range of issues than project-level configurations.

Multiple risk signals converge on a low-to-moderate real-world priority. The CVSS base score of 5.8 reflects the Changed Scope and network accessibility, but confidentiality impact is rated Low (C:L) with no integrity or availability components - this is a data exposure issue, not code execution. A significant discrepancy exists between the CVSS vector (PR:N, indicating no privileges required) and the CVE description, which explicitly states 'authenticated user' - this implies at minimum a valid GitLab account is required. This conflict should be verified with the vendor; if PR:N is incorrect, the effective exploitability for unauthenticated actors is zero. EPSS at 0.01% (3rd percentile) and SSVC exploitation status of 'none' confirm no observed real-world exploitation. However, SSVC flags the attack as 'Automatable: yes', meaning a script could systematically enumerate out-of-scope Jira issues once an authenticated session is obtained. KEV status is not confirmed - this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. The primary risk is targeted insider or low-privilege user abuse of misconfigured Jira integrations, not opportunistic mass exploitation.

An authenticated GitLab user on a self-managed instance - even one with minimal project-level permissions - navigates to a GitLab project that has the Jira integration enabled and queries Jira issues through the integration interface. Because the scope filter is only a display control, the user can manipulate or observe API responses to access Jira issues from projects outside the configured GitLab project scope, potentially reading confidential Jira tickets, internal roadmap items, or sensitive issue metadata. No public exploit code has been identified at time of analysis.