CVE-2026-2104: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.8.9Fixed in 18.9.5Fixed in 18.10.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.8.9 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.9.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.10.3
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-2104?
CVE-2026-2104 is categorized as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-2104?
To fix CVE-2026-2104, update GitLab to versions 18.8.9, 18.9.5, or 18.10.3.
What types of issues are affected by CVE-2026-2104?
CVE-2026-2104 affects confidential issues in GitLab that could be accessed by authenticated users.
Who is impacted by CVE-2026-2104?
CVE-2026-2104 impacts all versions of GitLab CE/EE from 18.2 to just before versions 18.8.9, 18.9.5, and 18.10.3.
Is CVE-2026-2104 specific to a GitLab environment?
Yes, CVE-2026-2104 specifically affects GitLab CE/EE environments and not other products.