Authorization bypass through user-controlled key in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-13319
Published: October 22, 2026
Vulnerability identifier: #VU157244
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-13319
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read milestone metadata from arbitrary private projects across the GitLab instance without project membership.
The vulnerability exists due to authorization bypass through a user-controlled key in the group milestones API when processing a user-supplied project filter parameter without authorization checks. A remote user can manipulate this filter to retrieve milestone titles, descriptions, and full project paths from private projects without membership.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-13319
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1