Database/Control plane, storage & DevOps
GitLab CE/EE: unauthenticated users can read confidential notes on public projects
Impact
An incorrect authorization check lets an unauthenticated visitor read confidential notes on public projects. For a GPU operator running GitLab as the CI/CD and infrastructure-as-code system for the fleet, confidential notes are where embargoed security issues, incident detail, and sometimes credential rotation discussion live. Disclosure is read-only and limited to notes on public projects, so the practical exposure depends on whether the instance hosts public projects at all. No integrity or availability impact is described.
Who can reach it
Anyone who can reach the GitLab web interface, including unauthenticated users, against public projects on the instance.
What to do
Upgrade to 19.2.8, 19.3.5, or 19.4.2 depending on the branch in use (all versions from 17.4 are affected). A GitLab upgrade is a control-plane service restart, not a fleet-wide action: no GPU node needs draining. Operators who cannot patch immediately can reduce exposure by making projects non-public.
References
Related entries
- OpenChoreo: autobuild webhook picks its provider from a caller-supplied header and accepts unsigned Bitbucket requestsCVE-2026-73840 · OpenChoreo API (POST /api/v1alpha1/autobuild webhook handler)Medium
- GitLab CE/EE: improper authorization on internal endpoints exposes credentials and tokensCVE-2026-82837 · GitLab CE/EE (internal data emission endpoints, authorization)Medium
- openstack-network-exporter: missing HTTP header timeouts let an unauthenticated attacker exhaust file descriptorsCVE-2026-83536 · openstack-network-exporter (Prometheus metrics HTTP server)Medium
- GitLab CE/EE: incorrect authorization lets an unauthenticated user read work items in private groups and projectsCVE-2026-84284 · GitLab CE/EE (work item authorization)Medium
- Ansible automation-controller: Bitbucket DC webhook ping skips HMAC check, enumerating webhook-enabled templatesCVE-2026-84717 · Red Hat Ansible Automation Platform automation-controller (Bitbucket Data Center webhook receiver)Medium
- GitLab CE/EE: GraphQL authorization flaw exposes internal and confidential system notes on public projectsCVE-2026-85529 · GitLab CE/EE (GraphQL API, internal and confidential system notes)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.