Executive brief
GitLab, a platform used by software teams to manage code and project workflows, contained a flaw in its integration with Jira. This issue allowed users to view Jira project information that should have been restricted, potentially exposing internal project details or issue tracking data. GitLab has released security updates to ensure that access controls are properly enforced for these integrations.
Technical details
An issue in GitLab CE/EE (versions 13.7 through 18.11.3) was identified where the Jira integration filter functioned as a display-side control rather than a server-side access enforcement mechanism. This vulnerability is classified as a 'Confused Deputy' (CWE-441) scenario where the integration could be leveraged to proxy requests to Jira without respecting the configured project scope. An authenticated attacker could exploit this to view Jira issues that should have been inaccessible based on the GitLab project configuration. The issue has been remediated in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Community Edition (CE) / Enterprise Edition (EE) 13.7 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3 to address the issue.
- 2026-05-14: disclosed: CVE-2026-3160 was published.