Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.
Published: 2026-10-13
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to CI Artifact Reports
Action: Patch
AI Analysis

Impact

GitLab omitted an authorization check that can allow a user with the reporter role to view CI artifact report content that they are not entitled to see. The flaw can expose proprietary or sensitive information from build artifacts, leading to a breach of confidentiality for projects that rely on restricted CI data.

Affected Systems

All GitLab Community and Enterprise Edition instances from version 13.8 up to, but excluding, 19.2.8, from 19.3 up to, but excluding, 19.3.5, and from 19.4 up to, but excluding, 19.4.2 are affected. Exact affected releases include 13.8 through 19.2.7, 19.3.0 through 19.3.4, and 19.4.0 through 19.4.1.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited or actively targeted threat. The flaw requires an authenticated user with reporter permissions, so the attack vector is limited to authenticated web or API access within the GitLab instance. The exclusion of a KEV listing and the moderate score imply that the immediate danger is low but a patch is still recommended to eliminate the missing authorization path.

Generated by OpenCVE AI on October 13, 2026 at 02:52 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.2.8, 19.3.5, 19.4.2 or above.

OpenCVE Recommended Actions

  • Upgrade to GitLab 19.2.8, 19.3.5, 19.4.2 or later.
  • If an upgrade cannot be performed immediately, limit or revoke reporter roles from users who do not require access to CI artifact reports.
  • Review and harden role‑based access controls to ensure that CI artifact report visibility aligns with project policy.

Generated by OpenCVE AI on October 13, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.
Title Incorrect Authorization in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-863
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-13T13:28:29.233Z

Reserved: 2026-04-18T19:04:19.221Z

Link: CVE-2026-6567

cve-icon Vulnrichment

Updated: 2026-10-13T13:19:42.406Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T02:16:59.547

Modified: 2026-10-14T14:08:18.757

Link: CVE-2026-6567

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T03:00:11Z

Weaknesses