CVE-2026-85529
5.3MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Unauthenticated attackers can read internal notes and confidential system notes on public projects over the network.
Root cause
Improper authorization checks in the GraphQL API expose confidential project notes to unauthenticated queries.
Affected systems
GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade GitLab to 19.2.8, 19.3.5, 19.4.2, or later. No interim workaround is documented, so prioritize patching.
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/627709Issue Tracking
- https://hackerone.com/reports/3975416Permissions Required