CVE-2026-13319

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13319", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-06-25T08:13:52.456Z", "datePublished": "2026-10-21T23:35:25.440Z", "dateUpdated": "2026-10-30T17:18:23.068Z"}, "containers": {"cna": {"title": "Authorization Bypass Through User-Controlled Key in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "https://gitlab.com/gitlab-org/gitlab", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "15.10", "status": "affected", "lessThan": "19.3.6", "versionType": "semver"}, {"version": "19.4", "status": "affected", "lessThan": "19.4.3", "versionType": "semver"}, {"version": "19.5", "status": "affected", "lessThan": "19.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604064"}, {"url": "https://hackerone.com/reports/3792168", "name": "HackerOne Bug Bounty Report #3792168", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 19.3.6, 19.4.3, 19.5.1 or above."}], "credits": [{"lang": "en", "value": "Thanks [a0xnirudh](https://hackerone.com/a0xnirudh) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-21T23:35:25.440Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13319", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:41:44.997432Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:18:23.068Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13319", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:41:44.997432Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:08:53.947Z"}}], "cna": {"title": "Authorization Bypass Through User-Controlled Key in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [a0xnirudh](https://hackerone.com/a0xnirudh) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "https://gitlab.com/gitlab-org/gitlab", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "15.10", "lessThan": "19.3.6", "versionType": "semver"}, {"status": "affected", "version": "19.4", "lessThan": "19.4.3", "versionType": "semver"}, {"status": "affected", "version": "19.5", "lessThan": "19.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 19.3.6, 19.4.3, 19.5.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604064"}, {"url": "https://hackerone.com/reports/3792168", "name": "HackerOne Bug Bounty Report #3792168", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-21T23:35:25.440Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13319", "state": "PUBLISHED", "dateUpdated": "2026-10-30T17:18:23.068Z", "dateReserved": "2026-06-25T08:13:52.456Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-10-21T23:35:25.440Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "https://gitlab.com/gitlab-org/gitlab", "vendor": "GitLab", "versions": [{"lessThan": "19.3.6", "status": "affected", "version": "15.10", "versionType": "semver"}, {"lessThan": "19.4.3", "status": "affected", "version": "19.4", "versionType": "semver"}, {"lessThan": "19.5.1", "status": "affected", "version": "19.5", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "B7CA6876-7833-4DBB-9633-707CF4FEF32F", "versionEndExcluding": "19.3.6", "versionStartIncluding": "15.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "D0852D6D-4302-4825-B2D2-C1349755B720", "versionEndExcluding": "19.3.6", "versionStartIncluding": "15.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "12A85E28-FB9B-477D-BE6F-DE307EFEB4E0", "versionEndExcluding": "19.4.3", "versionStartIncluding": "19.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "30C796E1-40AA-41AF-8186-A49F78DC528D", "versionEndExcluding": "19.4.3", "versionStartIncluding": "19.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*", "matchCriteriaId": "2032C266-304B-4C69-95CA-56904EA5A64F", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "7D6BE6DD-CA49-4E20-9541-22477632BA5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API."}, {"lang": "es", "value": "GitLab ha corregido un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 15.10 y anteriores a la 19.3.6, la 19.4 y anteriores a la 19.4.3, y la 19.5 y anteriores a la 19.5.1, que podr\u00eda haber permitido a un usuario autenticado leer metadatos de hitos, incluyendo t\u00edtulos, descripciones y rutas completas de proyectos, de proyectos privados arbitrarios en toda la instancia sin ninguna membres\u00eda de proyecto, debido a la falta de comprobaciones de autorizaci\u00f3n en un par\u00e1metro de filtro de proyecto proporcionado por el usuario en la API de hitos de grupo."}], "id": "CVE-2026-13319", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13319", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:41:44.997432Z", "version": "2.0.3"}}]}, "published": "2026-10-22T01:16:59.203", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604064"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3792168"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.10,19.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.4,19.4.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.5,19.5.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "created": "2026-10-22T05:15:07.095175+00:00", "updated": "2026-10-22T07:30:08.796580+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}