Executive brief
GitLab is a platform used by organizations to manage software development and source code. A security flaw in certain versions could allow an unauthorized user to discover the names of private projects that should otherwise be hidden. While this does not expose the actual code within those projects, it reveals sensitive organizational information about what projects exist.
Technical details
A missing authorization vulnerability (CWE-862) exists in GitLab CE/EE within the commit discussion display and cross-project reference pages. The flaw allows an attacker to confirm the existence of private projects by observing how the application handles references to them across different project contexts. This is an information disclosure vulnerability where the metadata (project existence) is leaked despite the project being set to private. The issue affects versions 9.1 through 18.11.6, 19.0.x before 19.0.4, and 19.1.x before 19.1.2. Patches have been released in versions 18.11.7, 19.0.4, and 19.1.2.
Affected products
- GitLab GitLab Community Edition (CE) 9.1 to 18.11.6, 19.0 to 19.0.3, 19.1 to 19.1.1
- GitLab GitLab Enterprise Edition (EE) 9.1 to 18.11.6, 19.0 to 19.0.3, 19.1 to 19.1.1
Timeline
- 2026-07-08: advisory: GitLab released security patches and advisory.
- 2026-07-08: patched: Fixed in versions 18.11.7, 19.0.4, and 19.1.2.