Live › vulnerability › CVE-2026-13319
Go to dashboardGitLab CE/EE versions from 15.10 up to fixed releases 19.3.6, 19.4.3 and 19.5.1 lack an authorization check on a project filter in the group milestones API. A signed-in user can read milestone titles, descriptions and full project paths from private projects they are not members of.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-managed GitLab CE/EE instances on versions from 15.10 before the fixed releases can be exposed, provided users with accounts can reach the group milestones API. Instances that run only fixed versions, or that do not allow untrusted users to sign in, are not affected. unknown for whether GitLab.com is affected.
No product ranges from the sources yet.
gitlab-rake gitlab:env:info or the version shown in the Admin area) against the fixed releases.19.3.6, 19.4.3 or 19.5.1 (or later) depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.
This page as .md · .json · in your agent: get_signal("CVE-2026-13319")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.