GitLab CE/EE: incorrect authorization lets an unauthenticated user read work items in private groups and projects

Impact

Under certain conditions an unauthenticated caller can read work item contents belonging to private groups and projects. On a fleet where GitLab is the CI/CD and infrastructure-as-code system, private work items routinely carry node inventories, maintenance plans, incident detail and occasionally credentials pasted into issue bodies - so this is an information disclosure against the operational record of the cluster, not just a product bug. Confidentiality only; no integrity or availability impact per the vendor vector. Fixed in 19.2.8, 19.3.x (see vendor notes for the 19.3 line), and 19.4.2; all versions from 17.11 are affected.

Who can reach it

Anyone who can reach the GitLab web endpoint, with no authentication. Exposure scales with whether the instance is internet-facing or restricted to an internal network.

What to do

Upgrade GitLab CE/EE to 19.2.8 or 19.4.2 (or later) per the 19.4.2 patch release. This is an application upgrade and service restart on the GitLab host or chart, not a fleet-wide action: no GPU node needs draining. If an upgrade cannot be scheduled immediately, restrict network reach to the instance in the meantime.

References

Related entries

• Ansible automation-controller: Bitbucket DC webhook ping skips HMAC check, enumerating webhook-enabled templatesCVE-2026-84717 · Red Hat Ansible Automation Platform automation-controller (Bitbucket Data Center webhook receiver)Medium
• GitLab CE/EE: GraphQL authorization flaw exposes internal and confidential system notes on public projectsCVE-2026-85529 · GitLab CE/EE (GraphQL API, internal and confidential system notes)Medium
• Checkmk REST API: host configuration GET responses return SNMP and IPMI credentials in clear textCVE-2026-92882 · Checkmk REST API (host and folder configuration endpoints)Medium
• DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls): Stack corruption inside the firmwareNCVD-2026-006-dmtf-libspdm-csr-generation-unde · DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls)Medium
• DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOG: A requester reads memory it was never authorisedNCVD-2026-007-dmtf-libspdm-responder-handling · DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOGMedium
• rclone (rc server, /debug/pprof handler): The pprof debug handler is mounted as its own route on the rcloneNCVD-2026-041-rclone-rc-server-debug-pprof-han · rclone (rc server, /debug/pprof handler)Medium