Improper Authorization in GitLab CE/EE Allows Access to Sensitive Credentials
CVE-2026-82837

5.3MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
15 September 2026

What is CVE-2026-82837?

A vulnerability in GitLab CE/EE versions from 10.1.0 to before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 has been identified, where certain conditions allowed an authenticated user to access sensitive credentials and tokens without proper authorization. This issue arose due to inadequate checks on internal data emission endpoints, creating potential security risks for users.

Affected Version(s)

GitLab 10.1.0 < 19.1.8

GitLab 19.2 < 19.2.6

GitLab 19.3 < 19.3.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/626540
https://hackerone.com/reports/3907835
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/610136

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [0xoroot](https://hackerone.com/0xoroot) for reporting this vulnerability through our HackerOne bug bounty program
.