CVE-2026-14351 in GitLab
Summary
by MITRE • 07/29/2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical authorization bypass flaw in GitLab's access control mechanisms that affected multiple version streams including community edition and enterprise edition installations. The security issue stems from inadequate validation of user permissions when processing requests related to confidential issues within merge request contexts. Under specific conditions, unauthorized users could exploit this weakness to gain visibility into sensitive issue titles that should only be accessible to authorized personnel with appropriate project permissions.
The technical implementation flaw manifests in the authorization checking logic that fails to properly verify whether a requesting user possesses sufficient privileges to access confidential issue metadata when the request originates from a publicly accessible merge request context. This misconfiguration allows unauthenticated attackers to perform API calls or direct requests that bypass normal permission boundaries, effectively creating a information disclosure channel. The vulnerability specifically impacts GitLab installations where confidential issues are configured within projects that also contain public merge requests, creating an attack surface through which sensitive metadata can be extracted.
From an operational perspective, this vulnerability poses significant risk to organizations relying on GitLab for source code management and collaboration, particularly those handling sensitive intellectual property or regulated data. The exposure of confidential issue titles could provide attackers with insights into ongoing development activities, security vulnerabilities being addressed, or business-critical features under development. This information disclosure could facilitate more sophisticated attacks by enabling threat actors to target specific areas of interest or understand project structures and timelines. The impact extends beyond simple metadata exposure since issue titles often contain meaningful context about the nature of underlying problems or features.
The remediation efforts focused on strengthening authorization checks within the merge request processing pipeline to ensure that all requests for confidential issue information undergo proper permission validation regardless of the access level of the requesting entity. GitLab implemented comprehensive fixes across affected version streams including 8.8 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0, requiring administrators to upgrade to the patched versions to eliminate the vulnerability. Organizations should also consider implementing additional monitoring controls to detect unusual patterns of access attempts that might indicate exploitation attempts against similar authorization bypass vulnerabilities.
This issue aligns with common weakness enumeration cwes such as cwe-285 which describes improper authorization scenarios and relates to attack techniques documented in the mitre att&ck framework under privilege escalation and credential access categories. The vulnerability demonstrates how insufficient input validation and access control enforcement can create persistent security risks that may remain undetected for extended periods, emphasizing the importance of regular security assessments and proper permission model reviews within collaborative development platforms.