CVE-2026-13319 Overview
CVE-2026-13319 is a missing authorization vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. An authenticated user can read milestone metadata from arbitrary private projects without holding membership in those projects. Exposed data includes milestone titles, descriptions, and full project paths. The root cause is a missing authorization check on a user-supplied project filter parameter in the group milestones API. GitLab remediated the issue in the 19.5.1, 19.4.3, and 19.3.6 patch releases.
Critical Impact
Any authenticated GitLab user can enumerate milestone metadata across private projects on an instance, exposing internal project names, roadmap context, and descriptive content intended for restricted audiences.
Affected Products
- GitLab CE/EE versions 15.10 through 19.3.5
- GitLab CE/EE versions 19.4 through 19.4.2
- GitLab CE/EE version 19.5.0
Discovery Timeline
- 2026-10-22 - CVE-2026-13319 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-13319
Vulnerability Analysis
The vulnerability resides in the GitLab group milestones API endpoint. The endpoint accepts a project filter parameter supplied by the requesting user. The handler does not verify that the caller has permission to access the referenced projects before returning milestone records tied to them. As a result, an authenticated low-privilege user can specify project identifiers for private projects they do not belong to and receive milestone data in the response. The exposed fields include milestone titles, descriptions, and full project paths. While no code execution or data modification is possible, the leaked information reveals internal product roadmaps, naming conventions, and project structure. Attackers can use this data to accelerate reconnaissance against the instance.
Root Cause
The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The group milestones API trusts a client-supplied project filter without enforcing project-level visibility checks. Standard GitLab access control normally restricts private project data to members, but this code path bypassed that enforcement.
Attack Vector
Exploitation requires only a valid authenticated session on the GitLab instance. The attacker issues a request to the group milestones API and sets the project filter parameter to the identifier of a private project. The API returns milestone metadata for that project despite the lack of membership. No user interaction, elevated privileges, or network position beyond standard API access is required. Refer to the GitLab Work Item Details and HackerOne Security Report for additional technical context.
Detection Methods for CVE-2026-13319
Indicators of Compromise
- Unusual volume of requests from a single authenticated user to the group milestones API endpoint.
- API requests specifying project filter parameters for projects where the requesting user holds no membership.
- Sequential or enumerated project identifiers in milestone API query strings originating from one account.
Detection Strategies
- Review GitLab production and API logs for /api/v4/groups/*/milestones requests that include a project_ids filter parameter.
- Correlate the requesting user identity against project membership records to flag cross-project access.
- Alert on authenticated accounts that query milestone endpoints for a wide range of project IDs within short time windows.
Monitoring Recommendations
- Forward GitLab audit and application logs to a centralized analytics platform for retention and query.
- Baseline normal milestone API usage per user and alert on statistical deviations.
- Monitor for new or dormant accounts suddenly accessing milestone APIs across multiple groups.
How to Mitigate CVE-2026-13319
Immediate Actions Required
- Upgrade self-managed GitLab instances to 19.5.1, 19.4.3, or 19.3.6 as applicable to the deployed major version.
- Audit API access logs for the group milestones endpoint since the vulnerable code was introduced to identify potential enumeration activity.
- Review and tighten account provisioning so that only required users hold authenticated access to the instance.
Patch Information
GitLab released fixes in versions 19.5.1, 19.4.3, and 19.3.6. GitLab.com was patched by the vendor. Self-managed administrators should apply the appropriate patch release immediately. See the GitLab Patch Release Announcement for release notes and upgrade instructions.
Workarounds
- No official workaround is published; the vendor recommends upgrading to a patched release.
- Restrict instance access to trusted users where feasible until the patch is deployed.
- Rotate or revoke personal access tokens belonging to accounts suspected of abusing the endpoint.
# Verify installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5
# Example: tail Rails production log for milestone API calls
sudo tail -f /var/log/gitlab/gitlab-rails/production_json.log \
| grep "/milestones"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
