CVE-2026-8937

Published: Sep 29, 2026Modified: Oct 5, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	19.0.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	19.0.0 ≤ version < 19.2.7
Gitlab Gitlab	19.3.0 ≤ version < 19.3.3
Gitlab Gitlab	Version 19.4.0
Gitlab Gitlab	Version 19.4.0

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/600533

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3702369

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.