CVE-2026-13319

4.3 Moyenne

Publiée le 22/10/2026 à 03:16 · Modifiée le 22/10/2026 à 03:16 · Reçue · Source : cve@gitlab.com

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.

Traduire en français

Produits concernés

GitLab

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	cve@gitlab.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-639

Références

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/604064
https://hackerone.com/reports/3792168

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories