CVE-2026-0602

GitLab CE/EE contains a vulnerability (CVE-2026-0602) where an authenticated user could disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process. Affected versions are 15.6 up to but not including 18.7.6, 18.7....

CVE-2026-0602 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering...

EUVD-2019-6557

Malware in sbrugna...

EUVD-2020-5583

Malware in sbrugna...

EUVD-2020-2550

Malware in sbrugna...

CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

GitLab 8.5 < 12.10.13 / 13.0 < 13.0.8 / 13.1 < 13.1.2 (CVE-2020-13323)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos CVE-2020-13323 Note that Nessus has not tested for this issue but...

BIT-GITLAB-2020-10085

GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles...

BIT-GITLAB-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

Design/Logic Flaw

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

UBUNTU-CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

GitLab Information Disclosure Vulnerability (CNVD-2020-58041)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

CVE-2020-13323

CVE-2020-13323 affects GitLab versions prior to 13.1. Under certain conditions, private merge requests could be read via Todos , an information-disclosure vulnerability. The connected documents specify the affected product and symptom but do not provide a root cause analysis or a confirmed patch/...

CVE-2020-13323

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos...

PT-2020-13464 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1 Description: A vulnerability was discovered that allows private merge requests to be read via Todos under certain conditions. Recommendations: For versions prior to 13.1, update to version 13.1 or later to resolv...

PT-2020-11910 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.3.5 through 12.8.1 Description: The issue allows information disclosure. A particular view was exposing merge private merge request titles. Recommendations: For GitLab versions 12.3.5 through 12.8.1, update to a version tha...

GitLab: Users with guest access can post notes to private merge requests, issues, and snippets

Vulnerability details A user with guest access to a group / project can post notes to private merge requests, issues, and snippets. Impact It seems it only allows an attacker to post notes to objects that the user doesn't have access to. I tried creating notes with slash commands, but unfortunate...