CVE-2026-14552: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which deployments need remediation?
GitLab CE/EE deployments running versions from 17.0 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 are affected.
Who could access the restricted information?
An authenticated user with Guest access could, under certain conditions, read confidential epic content that external authorization was intended to restrict.
What access does an attacker need?
The attacker needs an authenticated GitLab account with Guest-level access. No user interaction is required.
What is the potential impact?
The issue can expose confidential epic content, resulting in unauthorized disclosure of information. The provided severity data indicates no integrity or availability impact.