GitLab CE/EE Vulnerability Allows Unauthorized Access to Private Work Items
CVE-2026-84284

5.3MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-84284?

A security flaw in GitLab CE/EE allows unauthenticated users to access the contents of private work items from specific groups and projects. This vulnerability arises due to inadequate authorization checks in versions ranging from 17.11 up to but not including 19.2.8, all 19.3 versions, and 19.4 prior to 19.4.2. Organizations using these versions should upgrade promptly to avoid potential data leakage. The remediation addresses these vulnerabilities and secures the private information within the affected platforms.

Affected Version(s)

GitLab 17.11 < 19.2.8

GitLab 19.3 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627167
https://hackerone.com/reports/3551698
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [modhanami](https://hackerone.com/modhanami) for reporting this vulnerability through our HackerOne bug bounty program
.