Improper Handling of Parameters in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-2370US | high8.8 | — | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations tha… | ||||
02
references
External citations — patches, advisories, analysis.
- https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/FIX
- https://access.redhat.com/security/cve/CVE-2026-2370WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2452920WEB
- https://gitlab.com/gitlab-org/gitlab/-/work_items/589635WEB
- https://hackerone.com/reports/3522829WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-2370WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2370.jsonWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan