Database/Control plane, storage & DevOps
GitLab CE/EE: GraphQL authorization flaw exposes internal and confidential system notes on public projects
Impact
Improper authorization in the GraphQL API lets an unauthenticated caller read internal notes and confidential system notes on public projects. These are exactly the comments maintainers mark internal because they discuss embargoed issues, infrastructure detail or security triage, so the disclosure is of the discussion an operator deliberately kept off the public record. This is a distinct code path from the private-group work item leak fixed in the same release - different API surface and different affected version floor (19.2 onward rather than 17.11 onward). Confidentiality impact only.
Who can reach it
Anyone who can reach the GitLab GraphQL endpoint, unauthenticated. Only public projects are affected, so a fully private instance is less exposed.
What to do
Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2 per the 19.4.2 patch release. Application upgrade and service restart on the GitLab deployment; no node maintenance window needed.
References
Related entries
- Checkmk REST API: host configuration GET responses return SNMP and IPMI credentials in clear textCVE-2026-92882 · Checkmk REST API (host and folder configuration endpoints)Medium
- DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls): Stack corruption inside the firmwareNCVD-2026-006-dmtf-libspdm-csr-generation-unde · DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls)Medium
- DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOG: A requester reads memory it was never authorisedNCVD-2026-007-dmtf-libspdm-responder-handling · DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOGMedium
- rclone (rc server, /debug/pprof handler): The pprof debug handler is mounted as its own route on the rcloneNCVD-2026-041-rclone-rc-server-debug-pprof-han · rclone (rc server, /debug/pprof handler)Medium
- Nagios XI: systemd unit files shipped with unnecessary executable permissionsCVE-2025-34135 · Nagios XI (nagios.service systemd unit file permissions)Medium
- Junos Space: stored cross-site scripting across the management web UI lets one operator run actions as anotherCVE-2025-59981 · Juniper Junos Space (web UI - device, template, report and admin pages)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.