CVE-2026-13319: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which GitLab deployments are affected?
GitLab CE/EE versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected. The issue concerns the group milestones API.
What access does an attacker need?
An attacker needs an authenticated GitLab account with low privileges. They do not need membership in the private projects whose milestone metadata they access.
What information could be exposed?
An attacker could read milestone metadata from arbitrary private projects on the same GitLab instance, including milestone titles, descriptions, and full project paths.
How can this be remediated?
Upgrade GitLab CE/EE to 19.3.6, 19.4.3, or 19.5.1, as applicable to the release branch in use.