CVE-2026-0602: Authentication Bypass Using an Alternate Path or Channel in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What versions are affected by CVE-2026-0602?
CVE-2026-0602 affects GitLab CE/EE versions from 15.6 through 18.7.5, 18.8 through 18.8.5, and 18.9 through 18.9.1.
What is the impact of CVE-2026-0602?
CVE-2026-0602 allows an authenticated user to disclose metadata from private issues, merge requests, or other sensitive information.
How do I remediate CVE-2026-0602?
To remediate CVE-2026-0602, upgrade GitLab to version 18.7.6, 18.8.6, or 18.9.2 or later.
Is CVE-2026-0602 a critical vulnerability?
CVE-2026-0602 is considered a medium-severity vulnerability due to its potential impact on data confidentiality.
What should I do if I cannot upgrade to resolve CVE-2026-0602?
If unable to upgrade, review user permissions and restrict access to sensitive project information as a temporary measure against CVE-2026-0602.