CVE-2026-5377: GitLab Information Disclosure Vulnerability

CVE-2026-5377 Overview

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process. This vulnerability is classified as CWE-863 (Incorrect Authorization), representing a significant information disclosure risk for organizations relying on GitLab's access control mechanisms to protect sensitive issue data.

Critical Impact

Authenticated users can bypass access controls to view titles of confidential or private issues in public projects, potentially exposing sensitive project information, security vulnerabilities being tracked, or proprietary feature discussions.

Affected Products

• GitLab Community Edition (CE) version 18.11.0
• GitLab Enterprise Edition (EE) version 18.11.0
• All GitLab CE/EE versions from 18.11 before 18.11.1

Discovery Timeline

• 2026-04-22 - GitLab releases security patch version 18.11.1
• 2026-04-22 - CVE CVE-2026-5377 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-5377

Vulnerability Analysis

This vulnerability stems from improper access control implementation within GitLab's issue description rendering process. When GitLab renders issue descriptions in public projects, the access control checks fail to properly validate whether the authenticated user has permission to view referenced confidential or private issue titles. This allows any authenticated user to extract sensitive information from issue titles that should be restricted based on project visibility and user permissions.

The flaw specifically affects the issue description rendering pipeline, where cross-references to other issues are resolved and displayed. The authorization bypass occurs because the rendering component does not enforce the same access control policies as the direct issue viewing functionality.

Root Cause

The root cause is an incorrect authorization check (CWE-863) in the issue description rendering component. When processing issue references within descriptions, the system fails to verify whether the current user has the necessary permissions to view the referenced issue's title before including it in the rendered output. This creates an inconsistency between the access control enforced at the issue viewing level and the access control applied during description rendering.

Attack Vector

The attack vector is network-based, requiring only low privileges (any authenticated GitLab user) and no user interaction. An attacker can exploit this vulnerability by:

1. Authenticating to a GitLab instance with any valid user account
2. Navigating to a public project that contains issues referencing confidential or private issues
3. Viewing issue descriptions that contain references to confidential issues
4. Observing the improperly disclosed titles of confidential or private issues rendered in the description

The vulnerability allows information leakage through the improper rendering of issue cross-references. Rather than displaying a generic placeholder or access-denied message for confidential issue references, the system exposes the actual issue titles to unauthorized users. For detailed technical information, refer to the HackerOne Report #3640688 and GitLab Work Item #595553.

Detection Methods for CVE-2026-5377

Indicators of Compromise

• Unusual access patterns to public project issue pages by users who don't typically interact with those projects
• Increased API calls to issue endpoints from authenticated users outside normal team membership
• Log entries showing issue description rendering requests followed by navigation patterns suggesting information gathering

Detection Strategies

• Monitor GitLab audit logs for repeated access to public project issues by users who have no role in those projects
• Implement anomaly detection for users accessing multiple public project issue pages in rapid succession
• Review access logs for patterns indicating systematic enumeration of issues across public projects
• Enable GitLab's built-in audit event streaming to centralize and analyze access patterns

Monitoring Recommendations

• Configure alerting on GitLab audit logs for issue access events in public projects containing confidential issue references
• Implement network monitoring to detect unusual GitLab web traffic patterns from authenticated sessions
• Review confidential issue configurations to identify projects with mixed public/confidential issue visibility that may be at higher risk

How to Mitigate CVE-2026-5377

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.11.1 or later immediately
• Review confidential issues in public projects for potential exposure of sensitive titles
• Audit user access logs for any suspicious access patterns prior to patching
• Consider temporarily restricting issue description viewing in sensitive public projects until the patch is applied

Patch Information

GitLab has released version 18.11.1 to address this vulnerability. The patch implements proper access control validation during the issue description rendering process, ensuring that confidential and private issue titles are only displayed to users with appropriate permissions.

For complete patch details, see the GitLab Patch Release Announcement.

Workarounds

• Limit authentication to trusted users only until the patch can be applied
• Review and temporarily remove cross-references to confidential issues in public project issue descriptions
• Consider making affected projects private temporarily if they contain highly sensitive confidential issue references
• Implement additional network-level access controls to limit who can authenticate to the GitLab instance

# Upgrade GitLab to patched version
# For Omnibus installations:
sudo apt-get update && sudo apt-get install gitlab-ce=18.11.1-ce.0
# or for Enterprise Edition:
sudo apt-get update && sudo apt-get install gitlab-ee=18.11.1-ee.0

# Verify the installed version
sudo gitlab-rake gitlab:env:info