CVE-2026-84284: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab deployments are affected?
GitLab CE/EE is affected in versions from 17.11 before 19.2.8, all 19.3 versions, and versions before 19.4.2 in the 19.4 release line.
Does exploitation require a GitLab account or user interaction?
No. The issue could allow an unauthenticated user to read work item contents under certain conditions, and the supplied vector indicates no privileges or user interaction are required.
What information could be exposed?
The impact described is disclosure of work item contents from private groups and projects. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.