GitLab EUVD-2026-88689

Exploitation requires an authenticated GitLab account on an affected instance (versions 19.0 before 19.2.7, 19.3 before 19.3.3, or 19.4 before 19.4.1). The specific precondition is the presence of epics that are visible to the attacker but that link child work items (issues) residing in projects the attacker is NOT a member of; the missing authorization check on those linked work items is what exposes their titles and descriptions. Limiting factors: the attacker must be able to see the parent epic, the disclosure is confined to child items linked under visible epics (no arbitrary project browsing), and impact is read-only exposure of issue title/description text - no write access, credentials, or code execution.

This is a low-to-moderate severity information-disclosure flaw, and the signals are internally consistent rather than conflicting. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) issue with only low confidentiality impact and no integrity or availability effect - appropriate for an IDOR-style authorization gap that leaks issue titles and descriptions but grants no write access or code execution. POC/exploit code is publicly available (a HackerOne report, #3702369), so the barrier to reproduction is low, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data, so this should be treated as 'publicly available exploit code exists' rather than actively exploited. Net: a real but modest priority - worth patching promptly in GitLab because exploit details are public and GitLab often holds sensitive project data, but not an emergency given authentication is required, only low-sensitivity confidentiality is impacted, and the leak is scoped to child items linked under epics the attacker can already see. Data quality is good: vendor-reported with a published patch, so few unknowns.

An authenticated GitLab user (any low-privilege member of the instance) who can view an epic requests the linked child work items belonging to projects they are not a member of. Because authorization checks on those linked work items are missing, the server returns the private child issues' titles and descriptions, disclosing confidential planning or security content. Public exploit steps exist via HackerOne report #3702369, lowering the effort to reproduce.