CVE-2026-87719

Published: Sep 12, 2026Modified: Sep 28, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Affected (5)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	18.3.0 ≤ version < 18.11.12
Gitlab Gitlab	19.0.0 ≤ version < 19.0.9
Gitlab Gitlab	19.1.0 ≤ version < 19.1.8
Gitlab Gitlab	19.2.0 ≤ version < 19.2.6
Gitlab Gitlab	19.3.0 ≤ version < 19.3.2

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://gitlab.com/gitlab-org/gitlab/-/work_items/628160

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/4012289

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.