CVE-2026-14552
4.3MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated users with Guest access can view confidential epic contents that should be blocked by external authorization. They only need low-privilege network access to the GitLab instance.
Root cause
Improper authorization checks fail to enforce external authorization restrictions on confidential epics.
Affected systems
GitLab CE/EE versions 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2, or later. No workaround or interim mitigation is provided.
$ apt-get update && apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/604841Issue Tracking
- https://hackerone.com/reports/3809364Permissions Required