Executive brief
GitLab Enterprise Edition, a platform used by software teams to manage code and project workflows, contained a security flaw in its 'work items' feature. This vulnerability allowed users with very low-level access permissions to view metadata for tasks and projects that should have remained private. While this does not allow full access to source code, it could expose sensitive project details or organizational structure to unauthorized internal users.
Technical details
A missing authorization check (CWE-862) in GitLab Enterprise Edition (EE) allowed authenticated users with minimal access permissions to view metadata for work items in private projects. The vulnerability stems from improper access control within the work items component. An attacker would need to be authenticated to the GitLab instance but could exploit this over the network without user interaction. The impact is limited to information disclosure of metadata rather than full project content. The issue affects versions 18.9 through 18.11.7, 19.0 through 19.0.4, and 19.1 through 19.1.2, and has been remediated in the latest patch releases.
Affected products
- GitLab GitLab Enterprise Edition 18.9 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2
Timeline
- 2026-07-08: advisory: GitLab published the security advisory and patch release.
- 2026-07-08: patched: Fixed in versions 18.11.7, 19.0.4, and 19.1.2.