CVE-2026-84284

5.3Medium

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-863

Impact

Unauthenticated attackers can read work item contents from private projects and groups over the network. No credentials or user interaction are required.

Root cause

Incorrect authorization checks allow unauthorized access to private work item data.

Affected systems

GitLab CE/EE versions 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to GitLab CE/EE 19.2.8, 19.4.2, or the latest patched version. No interim workaround is documented, so patching is required.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/627167Issue Tracking
https://hackerone.com/reports/3551698Permissions Required

Source: nvd.nist.gov/vuln/detail/CVE-2026-84284