Incorrect authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-14552
Published: October 13, 2026
Vulnerability identifier: #VU154161
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14552
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read confidential epic content restricted by external authorization.
The vulnerability exists due to incorrect authorization checks in the work items GraphQL API when handling requests for epic content. A remote user can request epic content through the work items GraphQL API to read confidential epic content restricted by external authorization.
Exploitation requires Guest access.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-14552
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2