EUVD-2026-88688
GHSA-r9w4-9vh4-q9m8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as guest-level GitLab user
-
DeliveryAccess project/group with security policies
-
ExploitRequest private security policy content
-
ExecutionAuthorization check fails to restrict
-
ImpactRead unauthorized policy content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account with guest-level permissions on the GitLab EE instance (PR:L) and a target project or group where security policies are configured but the guest lacks authorization to view them. It applies only to GitLab Enterprise Edition (not affecting Community Edition equivalents) in the affected version ranges, and the description notes it triggers only 'under certain conditions,' limiting universal exploitability. No user interaction beyond the attacker's own request is required (UI:N). The impact is limited to reading private security-policy content (confidentiality only); no modification or denial of service is possible. |
| Impact | This is a genuine but low-severity information-disclosure flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) is internally consistent with the description: an authenticated network attacker with only guest-level privileges reads private security-policy content, yielding limited confidentiality impact and no integrity or availability effect. A public exploit reference exists (HackerOne report #3686230), so this counts as 'publicly available exploit code exists' - but that is NOT active exploitation: it is not in CISA KEV and no EPSS score was provided in the input. Net effect: a real, verified issue worth patching, but the low technical impact (read-only, low-value disclosure, single security-policy content), the requirement for a valid authenticated guest account, and the narrow 'under certain conditions' trigger keep real-world priority low. The 'Authentication Bypass' tag overstates the class - this is improper authorization (CWE-863, broken access control by an already-authenticated user), not an authentication bypass. |
| Exploit ScenarioDerived | An attacker who already holds a legitimate guest-level account on a GitLab EE instance (self-registered or a low-trust internal user) requests security-policy content in a project or group where policies are configured but they lack authorization. Due to improper authorization enforcement, the private policy content is returned, revealing security rules the attacker should not see. A public write-up exists on HackerOne (report 3686230), so a reproduction path is documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Information disclosure in GitLab Enterprise Edition allows an authenticated user with guest-level permissions to read private security policy content that they are not authorized to access. The flaw affects GitLab EE from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and it is rated CVSS 4.3 with confidentiality-only impact. Publicly available exploit code exists, but CISA KEV does not list this issue as actively exploited at time of analysis.
RemediationAI
Vendor-released patch: upgrade GitLab Enterprise Edition to 19.2.7 or later for the 17.9-to-19.2.x line, 19.3.3 or later for 19.3.x, or 19.4.1 or later for 19.4.x. The vendor patch release advisory is at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/. If immediate upgrading is not possible, limit guest-level membership in groups or projects that contain private security policies and audit existing guest access to those policy projects; this reduces exposure but can affect collaboration and may not cover all policy visibility paths. Review access logs for guest users reading security policy content and apply least-privilege membership changes as compensating controls. No other workaround is confirmed in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-863 incorrect authorization failure in GitLab Enterprise Edition security policy handling. GitLab security policies can be configured at group or project level, and access controls are supposed to prevent users with only guest membership from viewing private policy content. Due to improper authorization enforcement, a guest-level authenticated account can retrieve security policy details in affected versions, but only under certain conditions and only where such policies exist. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms remote, authenticated, no user interaction, confidentiality-only impact; Community Edition equivalents are not affected. Although tagged Authentication Bypass, the assessed root cause is broken access control rather than authentication bypass. The available references include the GitLab work item and a HackerOne report, alongside the 19.4.1 patch release advisory.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Remotely reachable web app (AV:N/AC:L); requires an authenticated guest account (PR:L); read-only disclosure of limited-sensitivity policy content gives C:L with no integrity or availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Exploit-DB