{"id":"CVE-2026-84284","state":"PUBLISHED","title":"Incorrect Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.","publishedAt":"2026-10-13T01:06:56.170Z","updatedAt":"2026-10-22T11:14:53.647Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"17.11","status":"affected","lessThan":"19.2.8","versionType":"semver"},{"version":"19.3","status":"affected","lessThan":"19.3.6","versionType":"semver"},{"version":"19.4","status":"affected","lessThan":"19.4.2","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"https://gitlab.com/gitlab-org/gitlab"}],"references":["https://gitlab.com/gitlab-org/gitlab/-/work_items/627167","https://hackerone.com/reports/3551698","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/84xxx/CVE-2026-84284.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-84284","state":"PUBLISHED","datePublished":"2026-10-13T01:06:56.170Z","dateUpdated":"2026-10-22T11:14:53.647Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2026-09-01T15:15:40.255Z"},"containers":{"cna":{"title":"Incorrect Authorization in GitLab","descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"17.11","status":"affected","lessThan":"19.2.8","versionType":"semver"},{"version":"19.3","status":"affected","lessThan":"19.3.6","versionType":"semver"},{"version":"19.4","status":"affected","lessThan":"19.4.2","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"https://gitlab.com/gitlab-org/gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/627167"},{"url":"https://hackerone.com/reports/3551698","name":"HackerOne Bug Bounty Report #3551698","tags":["technical-description","exploit","permissions-required"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2026-10-22T11:14:53.647Z"},"credits":[{"lang":"en","type":"finder","value":"Thanks [modhanami](https://hackerone.com/modhanami) for reporting this vulnerability through our HackerOne bug bounty program"}],"solutions":[{"lang":"en","value":"Upgrade to versions 19.2.8, 19.3.6, 19.4.2 or above."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-14T19:11:56.764013Z","id":"CVE-2026-84284","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T19:12:10.482Z"}}]}}}