CVE-2026-14552: GitLab Authorization Bypass Vulnerability

CVE-2026-14552 Overview

CVE-2026-14552 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability permits an authenticated user with Guest access to read confidential epic content that external authorization controls should restrict. The root cause is an incorrect authorization check [CWE-863] in the epic access path. GitLab remediated the issue across the 19.2.x, 19.3.x, and 19.4.x release branches.

Critical Impact
A low-privileged Guest user can disclose confidential epic content intended to be gated by external authorization, exposing restricted project planning data.

Affected Products

GitLab CE/EE versions 17.0 up to (but not including) 19.2.8
GitLab CE/EE versions 19.3 up to (but not including) 19.3.5
GitLab CE/EE versions 19.4 up to (but not including) 19.4.2

Discovery Timeline

2026-10-13 - CVE-2026-14552 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-14552

Vulnerability Analysis

The vulnerability is a Broken Access Control issue affecting confidential epics in GitLab. Epics group related issues across projects and groups, and may be marked confidential to restrict visibility. GitLab also supports external authorization services that enforce classification labels on resources.

Under specific conditions, GitLab failed to correctly evaluate authorization before returning confidential epic content. An authenticated Guest user could therefore read epic data that external authorization was expected to block. The issue is scoped to confidentiality: it does not permit modification of data or disruption of service.

Details of the fix are tracked in GitLab Work Item #604841 and the originating HackerOne Report #3809364.

Root Cause

The flaw maps to [CWE-863] Incorrect Authorization. The epic access check did not fully account for external authorization decisions when evaluating Guest-level requests. As a result, the policy layer allowed read access to resources it should have denied.

Attack Vector

Exploitation requires network access to the GitLab instance and valid credentials for an account with Guest role. No user interaction is required beyond issuing authenticated API or web requests to retrieve epic content. The attacker gains read access to confidential epic data but cannot alter it or affect availability.

No public proof-of-concept code or exploit modules are available for CVE-2026-14552. The vulnerability is documented in GitLab's advisory channels in prose form only; see the GitLab Patch Release 19.4.2 advisory for technical context.

Detection Methods for CVE-2026-14552

Indicators of Compromise

Guest-role accounts issuing requests to /api/v4/groups/*/epics or GraphQL epic queries targeting confidential epics.
Access log entries where Guest users successfully retrieve epics marked confidential or governed by external authorization labels.
Spikes in epic-read API traffic from accounts without historical epic activity.

Detection Strategies

Correlate GitLab audit events with the user role and the confidentiality attribute of accessed epics to identify role-vs-resource mismatches.
Query the GitLab audit API for read_epic events authored by Guest accounts and compare against external authorization classification labels.
Baseline normal epic access patterns per role and alert on deviations originating from Guest or lower privilege tiers.

Monitoring Recommendations

Forward GitLab production, API, and audit logs to a centralized analytics platform for retention and correlation across identity and role context.
Track GitLab version strings exposed by /help and /-/liveness endpoints to confirm patched versions are deployed across all instances.
Monitor external authorization service denials and compare them against GitLab-side allow decisions to surface divergence.

How to Mitigate CVE-2026-14552

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.4.2, 19.3.5, or 19.2.8 depending on the deployed release branch.
Audit recent epic-read activity from Guest accounts and rotate credentials for any accounts showing anomalous access.
Review Guest membership across groups hosting confidential epics and remove unnecessary access.

Patch Information

GitLab released fixes in versions 19.2.8, 19.3.5, and 19.4.2. Full remediation details are available in the GitLab Patch Release 19.4.2 advisory. Self-managed administrators should apply the patch corresponding to their current release branch rather than skipping branches.

Workarounds

Temporarily remove Guest-level members from groups containing confidential epics until the upgrade is applied.
Restrict access to the GitLab instance at the network layer so only trusted identities can authenticate.
Review and tighten external authorization service rules to deny Guest tokens outright for classified resources.

bash

# Verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# List Guest members of groups with confidential epics for review
curl --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/groups/<group_id>/members?query=&access_level=10"