Vulnerability in GitLab

[ Description ]Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL13 Oct 2026NCSC-2026-0414

  Vulnerabilities fixed in GitLab Translated from Dutch

  Probability/damage M/HCVE-2026-97229CVE-2026-92883CVE-2026-16301+21 more CVEs
• CERT-FR12 Oct 2026CERTFR-2026-AVI-1294

  Multiple vulnerabilities in GitLab Translated from French

  Multiple vulnerabilities have been discovered in GitLab. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and a breach of data integrity.

  CVE-2026-14552CVE-2026-82632CVE-2026-100755+21 more CVEs
• BSI CERT-Bund11 Oct 2026WID-SEC-2026-3858

  GitLab: Multiple vulnerabilities Translated from German

  CVE-2026-100104CVE-2026-97229CVE-2026-78335+21 more CVEs

[ References ]References

• docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-releasedRelease NotesVendor Advisory
• gitlab.com/gitlab-org/gitlab/-/work_items/627167Issue Tracking
• hackerone.com/reports/3551698Permissions Required