Executive brief
GitLab, a platform used by software teams to manage code and track project tasks, has fixed a security flaw that could allow authorized users to view confidential issue details they should not have access to. While an attacker must already have an account on the system, this bug could lead to the exposure of sensitive project information or internal discussions. The issue has been resolved in the latest software updates.
Technical details
An incorrect authorization check (CWE-863) in GitLab CE/EE versions 12.0 through 19.0.2 allows an authenticated user to bypass intended access restrictions. By exploiting this flaw, a user with low privileges can view details of issues marked as confidential, provided certain environmental conditions are met. The attack vector is network-based, though it requires a high complexity (AC:H) and existing user authentication (PR:L). GitLab has released patches in versions 18.10.8, 18.11.5, and 19.0.2 to remediate this vulnerability.
Affected products
- GitLab GitLab Community Edition (CE) / Enterprise Edition (EE) 12.0 to 18.10.8, 18.11 to 18.11.5, 19.0 to 19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2.
- 2026-06-11: disclosed: CVE-2026-3553 published.