Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T20:46:23 gitlab-ee: GitLab EE: Information disclosure via improper authorization controls 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CWE-266

GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.

A flaw was found in GitLab EE. An authenticated user with maintainer-role permissions could, under specific conditions, exploit improper authorization controls. This vulnerability allows the user to obtain other users' stored credentials, leading to unauthorized information disclosure.

OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-11827 https://nvd.nist.gov/vuln/detail/CVE-2026-11827 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/ https://gitlab.com/gitlab-org/gitlab/-/work_items/602478 https://hackerone.com/reports/3720483