Executive brief
GitLab has addressed a security flaw in its Community and Enterprise editions that could allow unauthorized individuals to discover the existence of private projects. GitLab is a widely used platform for software development and version control. While this issue does not allow access to the actual code or data within those projects, it could lead to the exposure of sensitive project names or organizational structures to the public.
Technical details
An incorrect authorization check (CWE-863) in GitLab CE/EE allows unauthenticated attackers to enumerate private projects via the network. The vulnerability exists in versions 18.2 through 19.0.0 and is triggered under specific conditions where authorization logic fails to properly restrict project visibility. While the attacker cannot access project contents, they can confirm the existence and names of private repositories. The issue has been remediated in versions 18.10.7, 18.11.4, and 19.0.1.
Affected products
- GitLab GitLab Community Edition (CE) 18.2 to <18.10.7, 18.11 to <18.11.4, 19.0 to <19.0.1
- GitLab GitLab Enterprise Edition (EE) 18.2 to <18.10.7, 18.11 to <18.11.4, 19.0 to <19.0.1
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched