CVE-2026-84284 Overview
CVE-2026-84284 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows unauthenticated users to read work item contents from private groups and projects. The issue stems from incorrect authorization checks in the work items subsystem and affects all versions from 17.11 before 19.2.8, all 19.3 releases, and 19.4 before 19.4.2. GitLab addressed the flaw in the 19.4.2 patch release. The weakness is classified under CWE-863: Incorrect Authorization.
Critical Impact
Unauthenticated network attackers can read confidential work item contents from private GitLab groups and projects, exposing issue descriptions, planning data, and potentially sensitive internal discussions.
Affected Products
- GitLab CE/EE versions 17.11 through 19.2.7
- GitLab CE/EE all 19.3.x versions
- GitLab CE/EE 19.4.0 and 19.4.1
Discovery Timeline
- 2026-10-13 - CVE-2026-84284 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-84284
Vulnerability Analysis
The vulnerability resides in GitLab's work items feature, which underpins issues, epics, tasks, and related planning objects. GitLab's authorization layer failed to properly validate whether the requester had permission to view work items belonging to private groups or projects. Under specific conditions, an unauthenticated HTTP request could retrieve work item contents that should be restricted to authorized members.
The disclosure limits impact to confidentiality only. Attackers cannot modify work items or affect service availability through this flaw. However, work items often contain sensitive planning data, security discussions, customer references, and architectural details that organizations expect to remain internal.
Root Cause
The root cause is an incorrect authorization check [CWE-863] in the code path serving work item content. The policy evaluation did not consistently enforce group and project visibility rules before returning data. See GitLab Work Item #627167 and the HackerOne Report #3551698 for technical details.
Attack Vector
Exploitation requires only network access to the target GitLab instance. No credentials, user interaction, or elevated privileges are needed. An attacker crafts a request against the vulnerable work item endpoint and parses the returned contents. Self-managed GitLab installations exposed to the internet are the primary exposure surface, though internal instances remain reachable to insiders and anyone with lateral network access.
No public proof-of-concept exploit code is listed in the advisory. See the GitLab Patch Release Notes for the official remediation guidance.
Detection Methods for CVE-2026-84284
Indicators of Compromise
- Unauthenticated HTTP requests to work item API endpoints returning HTTP 200 responses for resources inside private groups or projects.
- Anomalous volumes of GraphQL or REST queries targeting work_items, issues, or epics resources from unauthenticated sessions.
- Access patterns originating from IP addresses with no prior authenticated session history against the GitLab instance.
Detection Strategies
- Review GitLab production logs (production_json.log, api_json.log) for requests to work item endpoints lacking a valid authentication token or session cookie.
- Correlate GitLab access logs with front-end web server logs to identify unauthenticated reads returning non-empty payloads.
- Audit visibility of exposed GitLab instances and compare against the running version to confirm patch status.
Monitoring Recommendations
- Forward GitLab application and audit logs to a centralized analytics platform for continuous review.
- Alert on sustained unauthenticated access to work item endpoints across short time windows, which can indicate scraping attempts.
- Track GitLab version metadata via asset inventory and flag instances running 17.11 through 19.4.1 that are not yet patched.
How to Mitigate CVE-2026-84284
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE to version 19.4.2, 19.3.x fixed release, or 19.2.8 as applicable to your release channel.
- Inventory all GitLab instances, including development, staging, and shadow IT deployments, and prioritize internet-facing systems.
- Review access logs for the vulnerable window to identify any unauthenticated reads against work item endpoints.
Patch Information
GitLab released fixed versions 19.4.2, a patched 19.3 release, and 19.2.8. Refer to the GitLab Patch Release Notes for upgrade procedures and release artifacts. GitLab.com SaaS instances are maintained by GitLab and have been updated.
Workarounds
- No vendor-supplied workaround is published; upgrading is the recommended remediation path.
- Restrict network exposure of self-managed GitLab instances using firewall rules or VPN gating until the upgrade completes.
- Place the GitLab instance behind a web application firewall and block anonymous access to work item API endpoints where feasible.
# Example upgrade commands for Omnibus GitLab on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:check SANITIZE=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.