Dashboard / CVE-2026-13319

CVE-2026-13319

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-10-22 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.

Weakness Classification (1)

Affected Software (12)

VendorProductVersion
gitlab gitlab 15.10 – 19.3.6
gitlab gitlab 15.10 – 19.3.6
gitlab gitlab 19.4.0 – 19.4.3
gitlab gitlab 19.4.0 – 19.4.3
gitlab gitlab 19.5.0
gitlab gitlab 19.5.0
gitlab gitlab 15.10 – 19.3.6
gitlab gitlab 15.10 – 19.3.6
gitlab gitlab 19.4.0 – 19.4.3
gitlab gitlab 19.4.0 – 19.4.3
gitlab gitlab 19.5.0
gitlab gitlab 19.5.0

References & Advisories (3)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002380
Percentile 14.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00238
2026-10-28
0.00238

Intelligence Sources

nvd ref →

External Links