Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T20:46:33 gitlab-ee: gitlab: GitLab: Information disclosure of private project existence via improper authorization 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-862

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an unauthenticated user to determine the existence of a private project due to improper authorization controls on cross-project reference pages.

A flaw was found in GitLab. Under certain conditions, an unauthenticated user could determine the existence of a private project. This information disclosure is possible due to improper authorization controls on cross-project reference pages. This vulnerability allows an attacker to gain sensitive information about private projects.

Red Hat does not ship or distribute GitLab Community Edition (CE) or Enterprise Edition (EE), the products affected by this flaw. This CVE was matched to Red Hat container images (OpenShift Console, OpenShift Pipelines Console Plugin) solely because they bundle an unrelated third-party npm client library named "gitlab" (node-gitlab, github.com/jdalrymple/node-gitlab), a REST API wrapper for calling a remote GitLab server. This client library does not contain the GitLab server-side authorization logic affected by this vulnerability, and Red Hat products are not affected. Not applicable; Red Hat products are not affected by this vulnerability. OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-7492 https://nvd.nist.gov/vuln/detail/CVE-2026-7492 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/ https://gitlab.com/gitlab-org/gitlab/-/work_items/597947 https://hackerone.com/reports/3704739