Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-4523: GitLab may let strangers view job logs
CVE-2026-4523 · published 20 days ago
Summary
GitLab versions from 15.11 up to certain recent releases could let anyone without an account see the detailed output of CI/CD jobs, which may include secret values. This exposure happens because the system did not correctly check who was allowed to view that information. Update GitLab to the latest release or apply the provided patch to close the gap.
What to do
- Update gitlab to version 19.4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gitlab | gitlab |
< 19.2.7 >= 15.11.0, < 19.2.7 >= 19.3.0, < 19.3.3 19.4.0 |
| Bitnami | – | gitlab |
>= 19.4.0, < 19.4.1 Fix: upgrade to 19.4.1
|
Original advisory text
Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/ Release Notes Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/594294 Broken Link
- https://hackerone.com/reports/3590929 Permissions Required
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4523.j... Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-4523 URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-862Missing Authorization
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta