Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-3553: GitLab may expose private issue details to logged‑in users

CVE-2026-3553 · published 4 months ago

Summary

Any version of GitLab Community or Enterprise Edition from 12.0 up to before 18.10.8, 18.11, and 19.0 could let a signed‑in user see confidential issue information they should not access. This happens because the system checks the wrong permissions before showing the data. Update GitLab to the latest release that includes the fix, or apply the vendor’s recommended patch as soon as possible.

Original advisory text

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks.

References

https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-release... URL
https://gitlab.com/gitlab-org/gitlab/-/work_items/592295 URL
https://hackerone.com/reports/3578216 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3553.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3553 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published11 Jun 2026

Updated4 Nov 2026

First seen11 Jun 2026

Sources

CVE-2026-3553 · NVD

CVE-2026-3553 · OSV

Track software like this

Free during beta