{"id":"CVE-2026-13319","kind":"vulnerability","aliases":["CVE-2026-13319"],"related":[],"title":"GitLab: authenticated users can read private project milestone metadata","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.","summary":"GitLab CE/EE versions from 15.10 up to fixed releases 19.3.6, 19.4.3 and 19.5.1 lack an authorization check on a project filter in the group milestones API. A signed-in user can read milestone titles, descriptions and full project paths from private projects they are not members of.","severity":"medium","cvss":4.3,"epss":0.0022,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","other","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed GitLab version (for example `gitlab-rake gitlab:env:info` or the version shown in the Admin area) against the fixed releases.\n- unknown","fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` (or later) depending on the release line in use.","status":"open","published_at":"2026-10-22T01:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:31+00:00","updated_at":"2026-10-25T04:37:31+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:37:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` (or later) depending on the release line in use.","reach":"network","title":"GitLab: authenticated users can read private project milestone metadata","impact":"low","summary":"GitLab CE/EE versions from 15.10 up to fixed releases 19.3.6, 19.4.3 and 19.5.1 lack an authorization check on a project filter in the group milestones API. A signed-in user can read milestone titles, descriptions and full project paths from private projects they are not members of.","category":"other","nicknames":[],"who_cares":["gitlab","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Signed-in users read private milestone titles, descriptions and project paths.","analyst_note":"","how_to_check":"- Check the installed GitLab version (for example `gitlab-rake gitlab:env:info` or the version shown in the Admin area) against the fixed releases.\n- unknown","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Self-managed GitLab CE/EE instances on versions from 15.10 before the fixed releases can be exposed, provided users with accounts can reach the group milestones API. Instances that run only fixed versions, or that do not allow untrusted users to sign in, are not affected. unknown for whether GitLab.com is affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3428,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-13319':12A,15A '-2026':11A,14A '15.10':25B,80C '19.3.6':30B,82C '19.4':83C '19.4.3':31B,85C '19.5':87C '19.5.1':33B,89C 'across':111C 'affect':76C 'allow':93C 'api':46B,135C 'arbitrari':108C 'authent':2A,95C 'author':36B,121C 'ce/ee':22B,75C 'check':37B,122C 'could':91C 'cve':10A,13A 'descript':56B,102C 'due':118C 'filter':41B,129C 'fix':28B 'full':58B,104C 'gitlab':1A,16B,21B,68C,74C 'group':44B,133C 'host':20B 'includ':100C 'instanc':113C 'issu':72C 'lack':34B 'member':67B 'membership':117C 'metadata':9A,99C 'mileston':8A,45B,54B,98C,134C 'miss':120C 'paramet':130C 'path':60B,106C 'privat':6A,62B,109C 'project':7A,40B,59B,63B,105C,110C,116C,128C 'read':5A,53B,97C 'releas':29B 'remedi':70C 'self':19B 'self-host':18B 'sign':49B 'signed-in':48B 'suppli':127C 'titl':55B,101C 'user':3A,51B,126C 'user-suppli':125C 'version':23B,78C 'without':114C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab CE/EE instances on versions from 15.10 before the fixed releases can be exposed, provided users with accounts can reach the group milestones API. Instances that run only fixed versions, or that do not allow untrusted users to sign in, are not affected. unknown for whether GitLab.com is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13319","severity":null,"published_at":"2026-10-22T01:16:59+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-13319","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13319","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}