EUVD-2026-36232
GHSA-h8wc-8hmg-pcc9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable flaw requiring low-privilege auth and specific undisclosed conditions; only confidential issue text is exposed with no integrity or availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks.
AnalysisAI
Incorrect authorization checks in GitLab CE/EE expose confidential issue details to authenticated low-privileged users under specific conditions. The flaw spans an enormous version range starting from 12.0, meaning a large population of self-hosted GitLab instances running unpatched versions is potentially affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated GitLab session with at minimum low-privilege access to the target instance (consistent with CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.1 (Low) reflects limited scope: network-accessible (AV:N), high complexity (AC:H), low-privilege authentication required (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), and only limited confidentiality impact (C:L) with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated GitLab user with Guest-level or other low-privileged access to a project navigates to or queries a confidential issue, triggering the flawed authorization code path under the specific conditions required by AC:H. The publicly available HackerOne report (#3578216) documents the technique, allowing a malicious project member to read sensitive business, security, or development context that project owners intended to keep restricted. |
| Remediation | Vendor-released patches are available: upgrade to GitLab 18.10.8, 18.11.5, or 19.0.2 depending on your current release stream. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18
Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role us
Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack
Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows un
Uncontrolled resource consumption in GitLab CE/EE's file upload processing pipeline enables any authenticated user to tr
Share
External POC / Exploit Code
Leaving vuln.today