Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2026-5377
Published: May 18, 2026
Vulnerability identifier: #VU131660
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-5377
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose titles of confidential or private issues in public projects.
The vulnerability exists due to improper access control in issue description renderer when rendering issue descriptions. A remote user can access rendered issue content to disclose titles of confidential or private issues in public projects.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2026-5377
Install security update from vendor's website.
Gitlab Community Edition - addressed in versions 18.9.6, 18.10.4, 18.11.1
GitLab Enterprise Edition - addressed in versions 18.9.6, 18.10.4, 18.11.1
GitLab Enterprise Edition - addressed in versions 18.9.6, 18.10.4, 18.11.1