GitLab CE/EE EUVD-2026-98218

Exploitation targets GitLab CE/EE instances running affected versions (17.11 up to but not including 19.2.8, all 19.3 releases, and 19.4 before 19.4.2) and allows an unauthenticated user to read work item contents from private groups and projects via an incorrect authorization check. The flaw is explicitly gated by unspecified 'certain conditions' in GitLab's description, so it is not guaranteed against every default deployment - defenders should confirm the exact triggering state (likely a specific work-item visibility or group/project configuration) in GitLab advisory work-item 627167. Limiting factors: impact is confined to confidentiality of work item contents only (no write/integrity or availability impact), and the conditional nature narrows the realistic exposure below what the unauthenticated network vector alone implies.

This is a moderate-severity, well-characterized information-disclosure flaw (CWE-863, incorrect authorization) rather than a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates network-reachable, low-complexity, unauthenticated access with only a limited confidentiality impact and no integrity or availability impact, which is consistent with the description of an unauthenticated user reading work item contents from private groups and projects. Signals partially conflict: a public exploit reference exists (HackerOne #3551698) and the issue was responsibly reported by GitLab itself, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active, widespread exploitation - the POC should be treated as proof-of-concept, not confirmed in-the-wild abuse. The CVSS AC:L contrasts with the description's qualifier 'under certain conditions,' suggesting real-world exploitation may require a specific state or configuration that the base vector does not fully capture; verify the triggering conditions in the GitLab advisory before treating this as trivially exploitable. Net: a genuine but bounded data-exposure risk - prioritize patching for internet-facing or multi-tenant GitLab instances, but it is not a confidentiality-integrity-availability-wide critical.

An unauthenticated attacker on the network crafts requests to a vulnerable GitLab CE/EE instance and, under the specific conditions that trigger the flawed authorization check, retrieves the contents of work items belonging to private groups and projects they should not be able to see. A public exploit reference exists (HackerOne report #3551698), and because the CVSS vector is AV:N/AC:L/PR:N/UI:N the request requires no authentication or user interaction, though the 'certain conditions' caveat likely narrows when it actually succeeds.