CVE-2026-1080

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1080", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-16T20:34:06.208Z", "datePublished": "2026-02-11T11:33:41.565Z", "dateUpdated": "2026-02-11T15:35:58.862Z"}, "containers": {"cna": {"title": "Authorization Bypass Through User-Controlled Key in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "16.7", "status": "affected", "lessThan": "18.6.6", "versionType": "semver"}, {"version": "18.7", "status": "affected", "lessThan": "18.7.4", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/586477", "name": "GitLab Issue #586477", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3484568", "name": "HackerOne Bug Bounty Report #3484568", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "credits": [{"lang": "en", "value": "Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:33:41.565Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:35:19.935747Z", "id": "CVE-2026-1080", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:35:58.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1080", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:35:19.935747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:35:46.695Z"}}], "cna": {"title": "Authorization Bypass Through User-Controlled Key in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "16.7", "lessThan": "18.6.6", "versionType": "semver"}, {"status": "affected", "version": "18.7", "lessThan": "18.7.4", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/586477", "name": "GitLab Issue #586477", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3484568", "name": "HackerOne Bug Bounty Report #3484568", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:33:41.565Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1080", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:35:58.862Z", "dateReserved": "2026-01-16T20:34:06.208Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-11T11:33:41.565Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.6.6", "status": "affected", "version": "16.7", "versionType": "semver"}, {"lessThan": "18.7.4", "status": "affected", "version": "18.7", "versionType": "semver"}, {"lessThan": "18.8.4", "status": "affected", "version": "18.8", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "9C40909F-AEAD-4AC0-AD12-082D2E389042", "versionEndExcluding": "18.6.6", "versionStartIncluding": "16.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab EE que afectaba a todas las versiones desde la 16.7 anterior a la 18.6.6, la 18.7 anterior a la 18.7.4, y la 18.8 anterior a la 18.8.4 que, bajo ciertas condiciones, podr\u00eda haber permitido a un usuario autenticado acceder a datos de iteraci\u00f3n de grupos descendientes privados al consultar el endpoint de la API de iteraciones."}], "id": "CVE-2026-1080", "lastModified": "2026-06-17T10:14:57.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1080", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:35:19.935747Z", "version": "2.0.3"}}]}, "published": "2026-02-11T12:16:04.120", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link", "Issue Tracking"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/586477"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3484568"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[16.7,18.6.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.7,18.7.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.8,18.8.4)"}}], "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-18T12:41:00.949896+00:00", "value": {"mitigation_remediation": ["Upgrade the affected GitLab EE installation to version 18.6.6 or newer, or to 18.7.4, or to 18.8.4, which contain the fix for this authorization bypass.", "If an immediate upgrade is not possible, limit the use of the Iterations API for sensitive groups by adjusting group membership and role permissions to prevent unauthorized access.", "After applying the patch or implementing access restrictions, verify that the Iterations API no longer returns data from private descendant groups to users lacking explicit permission."], "summary": {"action": "Apply Patch", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affected all GitLab EE releases from 16.7 up to 18.5 inclusive, and also includes 18.6.x versions earlier than 18.6.6, 18.7.x before 18.7.4, and 18.8.x before 18.8.4. Upgrading one of these versions to the patched releases (18.6.6, 18.7.4, or 18.8.4 or later) removes the flaw.", "description_and_impact": "GitLab Enterprise Edition exposed a flaw in the Iterations API that could let an authenticated user query iteration data for private descendant groups. The problem stemmed from inadequate enforcement of group ownership checks, allowing a user with membership in a parent group to bypass permissions and read data that should remain inaccessible. This flaw is categorized as a CWE\u2011639 Authorization Bypass by User\u2011Controlled Key issue.", "risk_and_exploitability": "The CVSS score of 4.3 signals a moderate impact, and the EPSS score of less than 1 percent indicates a low probability of exploitation at this time. The vulnerability requires the attacker to be an authenticated user and to have some level of access to the parent group. While it does not provide an avenue for remote code execution or service disruption, it does allow unauthorized disclosure of sensitive project iteration information and could lead to broader privilege escalation if combined with other weaknesses. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild."}}}}, "created": "2026-02-11T21:45:46.339854+00:00", "updated": "2026-04-18T12:45:45.671875+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}