Database/Control plane, storage & DevOps

GitLab: group milestones API returns private-project milestone metadata without membership

CVSS 6.5CVE-2026-13319Control plane, storage & DevOpscurated

Impact

A missing authorization check on a user-supplied project filter in the group milestones API lets any authenticated user read milestone titles, descriptions and full project paths from arbitrary private projects anywhere on the instance, with no membership. Where GitLab is the CI/CD and infrastructure-as-code system for a GPU fleet, those paths and descriptions map the private estate - cluster repos, firmware and driver pipelines, customer-specific deployment projects - to anyone with an account, which is useful reconnaissance before a targeted attempt on the pipelines themselves. Read-only: no write, no code access, no pipeline execution.

Who can reach it

Network, authenticated. Any user account on the instance, including a low-privilege or self-registered one; no project membership needed.

What to do

Upgrade to GitLab 19.3.6, 19.4.3 or 19.5.1 (all versions from 15.10 are affected). Standard GitLab patch release and service restart on the host running GitLab; no fleet-wide action. If self-registration is open, consider who has had an account while the instance was vulnerable.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-13319 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/https://gitlab.com/gitlab-org/gitlab/-/work_items/604064 https://hackerone.com/reports/3792168

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.