CVE-2026-14552

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14552
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14552.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14552
Aliases
Downstream
CGA (168)
MINI (51)
UBUNTU (1)
Published
2026-10-13T01:08:31Z
Modified
2026-10-30T10:47:17Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14552.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
8c75d0bf4a4190d94326f1a854d0a102ceca4392
Fixed
9a42f777a0147768457ebe684e13e69d54eee652
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
ce7cbf1bcc4e49e98f209097d5081030e30410c5
Introduced
fa703f93afaf1133cd263f6aa0e91d284d7f1ebf
Fixed
9c053f678a4924425869b1b9e4bca3a44e45edf7
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "17.0.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "17.0.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.3.0-ee
v19.4.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14552.json"