CVE-2026-8937

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8937

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8937.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8937

Published

2026-09-29T09:35:33Z

Modified

2026-10-01T03:47:36Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Missing Authorization in GitLab

Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

Database specific

{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8937.json"
}

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

f07e3c5b3c8128be5db112e5b2b618fe31ea1b35

Fixed

9fcb5013c2e849eaec247e3aec56f23b51b6d7dd

Introduced

8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6

Fixed

5760a902b6c8d001a0e0212aedee40bd69d28a2d

Introduced

fa703f93afaf1133cd263f6aa0e91d284d7f1ebf

Fixed

26212baacadb5beea6664f7ef025d753dccfb0d6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "19.0"
        },
        {
            "fixed":  "19.2.7"
        },
        {
            "introduced":  "19.3"
        },
        {
            "fixed":  "19.3.3"
        },
        {
            "introduced":  "19.4"
        },
        {
            "fixed":  "19.4.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v19.*

v19.3.0-ee

v19.4.0-ee

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8937.json"