Executive brief
GitLab, a platform for software development and version control, has addressed a security flaw that could allow unauthorized individuals to view sensitive information about project imports. An attacker could potentially see details regarding where a project was imported from, which may include internal source information. This issue affects self-managed GitLab Community and Enterprise editions, and users are advised to upgrade to the latest patched versions to protect their data.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in GitLab CE/EE within the project import status functionality. The flaw is caused by a missing authorization check that allows an unauthenticated, remote attacker to view project import source information. This could lead to the disclosure of metadata or source details related to how projects were migrated into the instance. The issue affects versions 16.6 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1. GitLab has released patches in versions 19.0.5, 19.1.3, and 19.2.1 to address this vulnerability.
Affected products
- GitLab GitLab CE/EE 16.6 to 19.0.5, 19.1 to 19.1.3, 19.2 to 19.2.1
Timeline
- 2026-07-29: patched: GitLab released versions 19.2.1, 19.1.3, and 19.0.5.
- 2026-07-29: advisory: NVD published the CVE record.