CVE-2026-14351

mediumpriority · track · 0EPSS 0.004 · 34 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.40% (34th) EPSS

CVSS 4.3 · medium

Is it mine?

19 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · cve@gitlab.comexploitability 2.8 · impact 1.4

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1230USprimaryCWE-1230USCWE-1230US

affected products (19)

Products and version ranges known to be affected.

Open Source GitLab <19.0.5all versionscert_bundDE
Open Source GitLab <19.1.3all versionscert_bundDE
Open Source GitLab <19.2.1all versionscert_bundDE
Open Source GitLab< 19.0.5cert_bundDE
Open Source GitLab< 19.1.3cert_bundDE
Open Source GitLab< 19.2.1cert_bundDE
GitLab GitLab19.1 → 19.1.3enisa_euvdEU
GitLab GitLab19.2 → 19.2.1enisa_euvdEU
GitLab GitLab8.8 → 19.0.5enisa_euvdEU
GitLab Inc. Gitlab19.1 → 19.1.3fstec_bduRU
GitLab Inc. Gitlab19.2 → 19.2.1fstec_bduRU
GitLab Inc. Gitlab8.8 → 19.0.5fstec_bduRU
GitLab GitLab≤ vers:unknown/*ncsc_nlNL
gitlab gitlab19.1.0 → 19.1.3nvdUScpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
gitlab gitlab= 19.2.0nvdUScpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
gitlab gitlab8.8.0 → 19.0.5nvdUScpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Bitnami gitlab19.1.0 → 19.1.3osvUSpkg:bitnami/gitlab
Bitnami gitlab19.2.0 → 19.2.1osvUSpkg:bitnami/gitlab
Bitnami gitlab8.8.0 → 19.0.5osvUSpkg:bitnami/gitlab

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0270Kwetsbaarheden verholpen in GitLab door GitLab Inc.NL2026-07-30csaf · ncsc_nlNL
GitLab Inc. heeft meerdere kwetsbaarheden verholpen in GitLab, specifiek in versies voorafgaand aan 19.0.5, 19.1.3 en 19.2.1, inclusief GitLab Enterprise Edition (EE) versies binnen deze reeksen.
WID-SEC-W-2026-2586GitLab: Mehrere SchwachstellenDeutsch2026-07-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
BIT-gitlab-2026-14351Exposure of Sensitive Information Through Metadata in GitLab2026-08-17vendor · osvUS
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

published 2026-07-29modified 2026-08-03

related (26)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-9099US	high8.1	0.60% (48th)	—	2025-03-20
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or…
CVE-2024-53291US	high7.5	0.31% (24th)	—	2024-12-25
Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentiall…
CVE-2023-1974US	medium6.5	0.60% (48th)	—	2023-04-11
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.
CVE-2014-3562US	medium5.0	2.20% (82nd)	—	2014-08-21
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.
CVE-2023-50458US	medium4.3	0.22% (12th)	—	2025-07-10
In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.

+21 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan