CVE-2026-2238: GitLab CE/EE Auth Bypass Vulnerability

CVE-2026-2238 Overview

CVE-2026-2238 is an improper authorization vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an unauthenticated user to view confidential issue references on public projects under certain conditions. GitLab has remediated the issue, which affects all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated network attackers can disclose references to confidential issues in public GitLab projects, exposing sensitive project metadata and internal tracking information.

Affected Products

GitLab CE/EE versions 17.5 through 18.11.5
GitLab CE/EE versions 19.0 through 19.0.2
GitLab CE/EE versions 19.1 through 19.1.0

Discovery Timeline

2026-06-25 - CVE-2026-2238 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-2238

Vulnerability Analysis

The vulnerability stems from improper authorization checks in how GitLab processes issue references on public projects. Confidential issues in GitLab are intended to be visible only to project members with sufficient permissions. Under specific conditions, the platform fails to enforce those permission checks when rendering or surfacing references to confidential issues. Unauthenticated users can therefore retrieve information about issues they should not see.

The weakness is classified under CWE-862: Missing Authorization. The Exploit Prediction Scoring System (EPSS) places this CVE in the 13.8 percentile, indicating relatively low expected exploitation activity. No public proof-of-concept exploit is currently listed, and the issue is not present in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a missing or incomplete authorization check on a code path that exposes confidential issue references on public projects. The application logic treats certain reference lookups as belonging to the public project context, bypassing the additional check required to confirm that the requesting user can view the referenced confidential issue.

Attack Vector

Exploitation requires no authentication, no user interaction, and is performed over the network against a GitLab instance hosting public projects. An attacker interacts with the affected GitLab endpoints associated with issue references on public projects and observes responses that include data from confidential issues. Refer to the HackerOne Report #3543011 and the GitLab Work Item Discussion for technical details.

No verified exploit code is available for this advisory. See the linked references for additional context.

Detection Methods for CVE-2026-2238

Indicators of Compromise

Unauthenticated HTTP requests to public project endpoints that return content or metadata derived from confidential issues.
Anomalous access patterns from unauthenticated sessions enumerating issue reference identifiers on public projects.
GitLab application logs showing successful responses for confidential issue references without an authenticated session.

Detection Strategies

Review GitLab production logs (production_json.log, api_json.log) for unauthenticated requests targeting issue reference endpoints on public projects.
Correlate request bursts against issue-reference URLs with absent or anonymous user identifiers.
Compare GitLab instance version against the fixed versions 18.11.6, 19.0.3, and 19.1.1 to identify exposed deployments.

Monitoring Recommendations

Enable verbose access logging on GitLab web and API tiers and forward logs to a centralized analytics platform.
Alert on high-volume anonymous traffic to issue and reference endpoints from a single source.
Track baseline access patterns for public projects and flag deviations involving confidential issue identifiers.

How to Mitigate CVE-2026-2238

Immediate Actions Required

Upgrade self-managed GitLab CE/EE instances to 18.11.6, 19.0.3, or 19.1.1 depending on the current major release branch.
Audit recent access logs for unauthenticated requests against issue reference endpoints on public projects.
Inventory public projects containing confidential issues and verify whether sensitive references were exposed.

Patch Information

GitLab released fixed versions 18.11.6, 19.0.3, and 19.1.1 that enforce proper authorization checks on confidential issue references. Deployment details are documented in the GitLab Patch Release Notes. GitLab.com SaaS instances are updated by GitLab; self-managed administrators must apply the patch directly.

Workarounds

Restrict access to public projects that contain confidential issues until the patch is applied.
Temporarily convert affected projects to internal or private visibility where business requirements allow.
Place GitLab behind a web application firewall and rate-limit unauthenticated traffic to issue reference endpoints.

bash

# Verify GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Upgrade example for Omnibus GitLab on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.1.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart