Incorrect authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-84284
Published: October 13, 2026
Vulnerability identifier: #VU154158
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84284
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read work item contents from private groups and projects.
The vulnerability exists due to incorrect authorization checks in the GraphQL work item hierarchy when handling work item requests. A remote attacker can request work item contents through the GraphQL work item hierarchy to read work item contents from private groups and projects.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-84284
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.4.2