CVE-2026-2238: GitLab Confidential Issue Disclosure Vulnerability (CVSS 5.3)

Technical summary

CVE-2026-2238 is an authorization bypass vulnerability (CWE-862) in GitLab CE/EE. Under specific conditions, the application failed to properly validate user permissions before exposing confidential issue references in public projects to unauthenticated clients. The network-based vector with low attack complexity means no special conditions or user interaction are required for exploitation. The vulnerability is scoped to confidentiality impact only; integrity and availability are not affected.

Business impact

Organizations running vulnerable GitLab instances risk exposure of confidential project issues and related metadata to the public internet. Sensitive information such as planned features, security issues, internal discussions, or business-critical references embedded in issue tracking could become discoverable. For enterprises using GitLab as a collaborative development platform, this represents a data leakage risk that could expose competitive or security-sensitive roadmap information.

Affected systems

GitLab CE and EE versions 17.5 through 18.11.5, all versions of 19.0 before 19.0.3, and 19.1 before 19.1.1 are vulnerable. Self-hosted and cloud-based GitLab instances running these releases are in scope. The vulnerability specifically manifests when confidential issues exist on public projects.

Exploitability

This vulnerability requires no authentication, no special user interaction, and no unusual network configuration to exploit. An attacker simply needs network access to a vulnerable GitLab instance and can directly request issue references on public projects to retrieve confidential data. However, this is not listed on the CISA Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not been documented at the time of publication.

Remediation

Upgrade to GitLab 18.11.6, 19.0.3, or 19.1.1 or later, depending on your current major version. Organizations should verify the availability of these patch versions through their GitLab subscription channel and test upgrades in a staging environment before deploying to production. For instances where immediate patching is not feasible, restrict public project access or temporarily disable issue reference exposure until patched.

Patch guidance

Apply the following minimum patch versions: GitLab 17.x users should upgrade to 18.11.6 or jump to a later stable release; GitLab 19.0 users should upgrade to 19.0.3; GitLab 19.1 users should upgrade to 19.1.1. Verify patch availability through the official GitLab release notes and your subscription portal. Schedule upgrades during maintenance windows and confirm authorization checks are functioning by testing access to confidential issues from unauthenticated sessions post-patch.

Detection guidance

Search logs for unauthenticated API requests to issue endpoints on public projects, particularly those requesting confidential or internal issue details. Monitor for patterns of issue reference enumeration from single source IPs. Enable GitLab audit logging to track access to sensitive issues. Compare access logs against your authenticated user list to identify anomalous unauthenticated activity. Check project audit trails for unexpected reference exposures.

Why prioritize this

Although this is a MEDIUM severity vulnerability with low exploitability (CVSS 5.3), it directly enables confidential data exposure on internet-accessible systems. Organizations with public GitLab projects containing sensitive issue references should prioritize patching. The lack of KEV listing suggests lower real-world urgency, but the ease of exploitation and potential for information disclosure warrant prompt remediation within standard change windows.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a low-barrier attack (network-based, no authentication, low complexity) against confidentiality. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates the impact is limited to partial loss of confidentiality with no integrity or availability compromise. The score is elevated by the unauthenticated, network-accessible nature but capped by the narrow scope (confidentiality only) and absence of system-wide impact.

Frequently asked questions