PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8472 GitLab CVE debrief

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. The issue has been remediated in versions 18.11.7, 19.0.4, and 19.1.2.

Vendor
GitLab
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-08
Original CVE updated
2026-07-10
Advisory published
2026-07-08
Advisory updated
2026-07-10

Who should care

Users of GitLab EE versions 18.9 through 18.11.6, 19.0 through 19.0.3, and 19.1 through 19.1.1 should apply patches or mitigations to prevent potential unauthorized access to work item metadata in private projects. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of their projects.

Technical summary

The vulnerability, with a CVSS score of 4.3, involves missing authorization checks in GitLab EE, allowing authenticated users with minimal access permissions to read work item metadata from private projects under certain conditions. The issue has been remediated in versions 18.11.7, 19.0.4, and 19.1.2. Users of affected versions should apply patches or mitigations to prevent potential unauthorized access to work item metadata in private projects.

Defensive priority

Medium priority due to the potential for unauthorized access to sensitive project metadata.

Recommended defensive actions

  • Apply patches or updates to affected GitLab EE versions
  • Review and adjust access permissions for users and projects
  • Monitor project metadata access logs for suspicious activity
  • Consider implementing additional security controls for sensitive projects
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-08T21:16:55.327Z and was last modified on 2026-07-10T13:02:22.957Z. The NVD entry is currently Analyzed. The vulnerability affects GitLab EE versions 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. The issue involves missing authorization checks, allowing authenticated users with minimal access permissions to read work item metadata from private projects under certain conditions.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-08T21:16:55.327Z and has not been modified since then. The NVD entry is currently Analyzed.