PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8472 GitLab CVE debrief

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. The issue has been remediated in versions 18.11.7, 19.0.4, and 19.1.2.

Vendor
GitLab
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-08
Original CVE updated
2026-07-10
Advisory published
2026-07-08
Advisory updated
2026-07-10

Who should care

Users of GitLab EE versions 18.9 through 18.11.6, 19.0 through 19.0.3, and 19.1 through 19.1.1 should apply patches or mitigations to prevent potential unauthorized access to work item metadata in private projects. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of their projects.

Technical summary

The vulnerability, with a CVSS score of 4.3, involves missing authorization checks in GitLab EE, allowing authenticated users with minimal access permissions to read work item metadata from private projects under certain conditions. The issue has been remediated in versions 18.11.7, 19.0.4, and 19.1.2. Users of affected versions should apply patches or mitigations to prevent potential unauthorized access to work item metadata in private projects.

Defensive priority

Medium priority due to the potential for unauthorized access to sensitive project metadata.

Recommended defensive actions

  • Apply patches or updates to affected GitLab EE versions
  • Review and adjust access permissions for users and projects
  • Monitor project metadata access logs for suspicious activity
  • Consider implementing additional security controls for sensitive projects
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-08T21:16:55.327Z and was last modified on 2026-07-10T13:02:22.957Z. The NVD entry is currently Analyzed. The vulnerability affects GitLab EE versions 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. The issue involves missing authorization checks, allowing authenticated users with minimal access permissions to read work item metadata from private projects under certain conditions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8472 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8472

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8472 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8472

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.