Executive brief
GitLab has fixed a security flaw in its Community and Enterprise editions that could allow users to view confidential information they are not authorized to see. Specifically, an authenticated user could exploit a weakness in the CSV export feature to access private issues assigned to other people. This could lead to the exposure of sensitive project details or internal bug reports.
Technical details
An authorization bypass vulnerability (CWE-639) exists in GitLab CE/EE due to insufficient authorization checks within the CSV export functionality. An authenticated attacker can exploit this flaw to export and view confidential issues that are assigned to other users, which should otherwise be restricted. The vulnerability affects versions 18.2 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2. GitLab has released patches in versions 18.8.9, 18.9.5, and 18.10.3 to address the issue by implementing proper authorization validation.
Affected products
- GitLab GitLab Community Edition 18.2 to 18.8.8, 18.9 to 18.9.4, 18.10 to 18.10.2
- GitLab GitLab Enterprise Edition 18.2 to 18.8.8, 18.9 to 18.9.4, 18.10 to 18.10.2
Timeline
- 2026-04-08: patched: GitLab released versions 18.10.3, 18.9.5, and 18.8.9
- 2026-04-08: disclosed: Initial advisory publication