CVE-2026-1080: GitLab Information Disclosure Vulnerability

CVE-2026-1080 Overview

CVE-2026-1080 is an authorization bypass vulnerability in GitLab Enterprise Edition (EE) that allows authenticated users to access iteration data from private descendant groups through improper access control in the iterations API endpoint. This vulnerability enables unauthorized information disclosure, potentially exposing sensitive project planning and iteration details to users who should not have access to private group information.

Critical Impact

Authenticated users can access sensitive iteration data from private descendant groups, potentially exposing confidential project planning information and organizational data that should be restricted.

Affected Products

• GitLab Enterprise Edition versions 16.7 before 18.6.6
• GitLab Enterprise Edition versions 18.7 before 18.7.4
• GitLab Enterprise Edition versions 18.8 before 18.8.4

Discovery Timeline

• 2026-02-10 - GitLab releases security patch
• 2026-02-11 - CVE CVE-2026-1080 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-1080

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly validate authorization when processing requests to the iterations API endpoint. Under certain conditions, the access control mechanism does not adequately verify that the requesting user has appropriate permissions to view iteration data from private descendant groups within the GitLab group hierarchy.

The flaw exists in how GitLab EE handles authorization checks when querying iteration data through its API. When a user makes a request to the iterations API endpoint, the system fails to properly validate group membership and access permissions for descendant private groups, allowing data leakage across the group hierarchy boundaries.

Root Cause

The root cause of CVE-2026-1080 lies in insufficient authorization validation within the iterations API endpoint. GitLab's group hierarchy allows for nested groups with varying visibility settings. The vulnerable code path fails to properly enforce access control when traversing the group tree, specifically when checking permissions for iteration data belonging to private descendant groups. This results in the authorization logic not correctly restricting access based on the authenticated user's actual group membership and permission level.

Attack Vector

The attack vector for this vulnerability is network-based and requires low privilege authentication. An attacker must have a valid authenticated session to the GitLab instance. The exploitation process involves:

1. The attacker authenticates to the GitLab instance with any valid user account
2. The attacker identifies target groups that may have private descendant groups
3. The attacker crafts API requests to the iterations endpoint targeting the group hierarchy
4. Due to the authorization bypass, iteration data from private descendant groups is returned in the API response
5. The attacker can extract sensitive project planning information including iteration names, dates, and associated metadata

The vulnerability requires no user interaction and can be exploited reliably due to the low attack complexity. For detailed technical information, refer to the GitLab Issue Discussion and the HackerOne Security Report #3484568.

Detection Methods for CVE-2026-1080

Indicators of Compromise

• Unusual API activity targeting the iterations endpoint from authenticated users
• API requests to iterations endpoints that include private group identifiers from users without proper group membership
• Unexpected access patterns showing users retrieving iteration data across multiple groups they are not members of
• Anomalous query patterns in GitLab logs showing iteration data requests for descendant groups

Detection Strategies

• Monitor GitLab API access logs for requests to /api/v*/groups/*/iterations endpoints
• Implement alerting for iteration API queries that cross group boundaries, particularly involving private groups
• Review audit logs for patterns of iteration data access by users without corresponding group membership
• Deploy SIEM rules to correlate authentication events with iteration API access patterns

Monitoring Recommendations

• Enable detailed API request logging in GitLab to capture iteration endpoint access
• Configure log aggregation to track cross-group data access patterns
• Implement periodic access reviews for sensitive group hierarchies
• Deploy SentinelOne Singularity XDR to monitor for anomalous API behavior and potential data exfiltration attempts

How to Mitigate CVE-2026-1080

Immediate Actions Required

• Upgrade GitLab EE to patched versions: 18.6.6, 18.7.4, or 18.8.4 immediately
• Review API access logs for any suspicious iteration data access patterns
• Audit group hierarchies to identify sensitive private descendant groups
• Consider temporarily restricting API access if immediate patching is not possible

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following versions based on their current deployment:

• For versions 16.7 to 18.6.x: Upgrade to 18.6.6
• For versions 18.7.x: Upgrade to 18.7.4
• For versions 18.8.x: Upgrade to 18.8.4

The patch implements proper authorization checks in the iterations API endpoint to ensure users can only access iteration data from groups where they have explicit permissions. Refer to the GitLab Patch Release Announcement for complete release notes and upgrade instructions.

Workarounds

• Restrict API token permissions to limit the scope of potential unauthorized access
• Implement network-level access controls to limit who can access the GitLab API
• Use GitLab's IP allowlist feature to restrict API access to trusted networks
• Review and minimize the number of users with API access tokens until patching is complete

# Configuration example
# Verify current GitLab version
gitlab-rake gitlab:env:info

# Check for available updates
apt-get update && apt-cache policy gitlab-ee

# Perform upgrade to patched version
apt-get install gitlab-ee=18.8.4-ee.0

# Reconfigure GitLab after upgrade
gitlab-ctl reconfigure

# Verify the upgrade was successful
gitlab-rake gitlab:check