Executive brief
GitLab is a platform used by software teams to manage code and track project tasks. A security flaw was found where unauthorized users could see the titles of private, confidential issues if they were linked to a public code change request. While the full content of the private issue remains hidden, the exposure of the title could leak sensitive project details or internal plans.
Technical details
An improper authorization vulnerability exists in GitLab CE/EE versions 8.8 through 19.2.1. The flaw resides in the merge request component, where metadata from linked confidential issues is not correctly restricted. An unauthenticated or low-privileged attacker can view the title of a confidential issue by accessing a publicly available merge request that references it. This is classified as an Information Exposure (CWE-1230) due to missing authorization checks during title generation. GitLab has released patches in versions 19.0.5, 19.1.3, and 19.2.1 to address this issue.
Affected products
- GitLab GitLab Community Edition (CE) 8.8 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
- GitLab GitLab Enterprise Edition (EE) 8.8 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
Timeline
- 2026-07-29: advisory: GitLab released security patches and advisory.
- 2026-07-29: patched: Fixed in versions 19.0.5, 19.1.3, and 19.2.1.