---
id: "CVE-2026-13319"
kind: "vulnerability"
aliases: ["CVE-2026-13319"]
title: "GitLab: authenticated users can read private project milestone metadata"
severity: "medium"
cvss: 4.3
epss: 0.0022
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gitlab", "other", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-10-22T01:16:59+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:37:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13319", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-13319", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab: authenticated users can read private project milestone metadata

GitLab CE/EE versions from 15.10 up to fixed releases 19.3.6, 19.4.3 and 19.5.1 lack an authorization check on a project filter in the group milestones API. A signed-in user can read milestone titles, descriptions and full project paths from private projects they are not members of.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GitLab version (for example `gitlab-rake gitlab:env:info` or the version shown in the Admin area) against the fixed releases.
- unknown

## Fix

- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` (or later) depending on the release line in use.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13319
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-13319

## From the sources

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_