CVE-2020-26417: Infoleak
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 13.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26417?
CVE-2020-26417 is considered a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2020-26417?
To fix CVE-2020-26417, upgrade GitLab versions to at least 13.6.2, 13.5.5, or 13.4.7 or later.
What software is affected by CVE-2020-26417?
CVE-2020-26417 affects GitLab CE and EE versions between 13.1.0 and 13.4.7, 13.5.0 and 13.5.5, as well as 13.6.0 and 13.6.2.
What type of information does CVE-2020-26417 expose?
CVE-2020-26417 exposes private group and project membership information.
What is the impact of CVE-2020-26417?
The impact of CVE-2020-26417 is the potential unauthorized access to sensitive membership details within private projects and groups.