Is CVE-2026-14552 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14552 being exploited in the wild.

How severe is CVE-2026-14552?

Medium severity, with a CVSS score of 4.3, published 13 October 2026.

Which products and versions are affected?

GitLab EE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab CE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.

Is there a fix for CVE-2026-14552?

Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14552 attacked?

It is attacked over the network.

Am I affected by CVE-2026-14552?

Check whether you run GitLab EE, GitLab or GitLab CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14552: GitLab incorrect authorization in epic content access

CVE-2026-14552 · Severity: medium · CVSS 4.3 · Published 2026-10-13

GitLab, a web-based platform for software development and collaboration, contains an authorization flaw that allows users with Guest access to read confidential epic content that should be restricted. An attacker with a low-privilege guest account could view sensitive project planning information not intended for their access level.

Technologies: GitLab EE, GitLab, GitLab CE. Vendors: GitLab.

Quick answers

Is CVE-2026-14552 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14552 being exploited in the wild.
How severe is CVE-2026-14552?: Medium severity, with a CVSS score of 4.3, published 13 October 2026.
Which products and versions are affected?: GitLab EE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1; GitLab CE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1.
Is there a fix for CVE-2026-14552?: Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14552 attacked?: It is attacked over the network.
Am I affected by CVE-2026-14552?: Check whether you run GitLab EE, GitLab or GitLab CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GitLab CE/EE 19.2.8, 19.3.5, 19.4.2

Technical details

An incorrect authorization check in GitLab CE/EE allows authenticated users with Guest role to access confidential epic content that should be restricted by external authorization controls. The vulnerability requires valid user authentication and affects versions 17.0 through 19.4.1. The flaw enables privilege escalation to read restricted project planning data without requiring code execution or elevated permissions.

Affected products

GitLab CE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1
GitLab EE 17.0 to 19.2.7, 19.3.0 to 19.3.4, 19.4.0 to 19.4.1

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.